General

  • Target

    d8ae13d3ccf988ee70563f4664310320_NeikiAnalytics

  • Size

    951KB

  • Sample

    240515-sylbkaga84

  • MD5

    d8ae13d3ccf988ee70563f4664310320

  • SHA1

    775525d559d5fa0f04b184c5e07b4f3cb4c0f2fc

  • SHA256

    67acf644130203782b558cbd76568d80aa2739001c6df3aa610e2cd16702973e

  • SHA512

    2db4609a8b1dd144b41880e6235b8dcc96049497558021057607c9d0c542bd089ae52045f799b46b31bd0b110c8c87b764e14db85637d9fb7ecfb713b27beeef

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5F:Rh+ZkldDPK8YaKjF

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      d8ae13d3ccf988ee70563f4664310320_NeikiAnalytics

    • Size

      951KB

    • MD5

      d8ae13d3ccf988ee70563f4664310320

    • SHA1

      775525d559d5fa0f04b184c5e07b4f3cb4c0f2fc

    • SHA256

      67acf644130203782b558cbd76568d80aa2739001c6df3aa610e2cd16702973e

    • SHA512

      2db4609a8b1dd144b41880e6235b8dcc96049497558021057607c9d0c542bd089ae52045f799b46b31bd0b110c8c87b764e14db85637d9fb7ecfb713b27beeef

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5F:Rh+ZkldDPK8YaKjF

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks