General

  • Target

    31ef81a2fb17504ad74a0aef8b6e51c0_NeikiAnalytics

  • Size

    950KB

  • Sample

    240511-ymactahd62

  • MD5

    31ef81a2fb17504ad74a0aef8b6e51c0

  • SHA1

    755fa6a4df9453807ebaf2b66bf998b5763d0ae8

  • SHA256

    f007267c020b8f169d5e5318e6539bb96f2970c02f56a9b71a1783f5a6682d20

  • SHA512

    ede847e99f717ac0e471db5c22a757e10d9124321b9db7f54071d23025033e43ac2502bb48e0f3a3c5e43f7083dd7719622fc84c975b7ce5c8fc06584e253d84

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5P:Rh+ZkldDPK8YaKjP

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      31ef81a2fb17504ad74a0aef8b6e51c0_NeikiAnalytics

    • Size

      950KB

    • MD5

      31ef81a2fb17504ad74a0aef8b6e51c0

    • SHA1

      755fa6a4df9453807ebaf2b66bf998b5763d0ae8

    • SHA256

      f007267c020b8f169d5e5318e6539bb96f2970c02f56a9b71a1783f5a6682d20

    • SHA512

      ede847e99f717ac0e471db5c22a757e10d9124321b9db7f54071d23025033e43ac2502bb48e0f3a3c5e43f7083dd7719622fc84c975b7ce5c8fc06584e253d84

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5P:Rh+ZkldDPK8YaKjP

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks