General

  • Target

    d770fa3c06d754c0dc2ad3f0f74cf9d0_NeikiAnalytics

  • Size

    951KB

  • Sample

    240509-x569tsdh44

  • MD5

    d770fa3c06d754c0dc2ad3f0f74cf9d0

  • SHA1

    4b24b68f5d662171119d4666906caa45437ef8dd

  • SHA256

    56e6c0b44313f0e4af24084da1095df079c684babd0c9e8ae288c4a824118c46

  • SHA512

    87e960118d3a8b3bee746c23eb1d88d29d9de6657324b6eeadf4157d45d132399f83d10a4873f46343360928e133c86b52cf6fa6a8c3dde1e6bbeb6f725ba1d0

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5U:Rh+ZkldDPK8YaKjU

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      d770fa3c06d754c0dc2ad3f0f74cf9d0_NeikiAnalytics

    • Size

      951KB

    • MD5

      d770fa3c06d754c0dc2ad3f0f74cf9d0

    • SHA1

      4b24b68f5d662171119d4666906caa45437ef8dd

    • SHA256

      56e6c0b44313f0e4af24084da1095df079c684babd0c9e8ae288c4a824118c46

    • SHA512

      87e960118d3a8b3bee746c23eb1d88d29d9de6657324b6eeadf4157d45d132399f83d10a4873f46343360928e133c86b52cf6fa6a8c3dde1e6bbeb6f725ba1d0

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5U:Rh+ZkldDPK8YaKjU

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks