General

  • Target

    dffaa48094d2cee60c22d28e07630170_NeikiAnalytics

  • Size

    950KB

  • Sample

    240516-qeqe3aef35

  • MD5

    dffaa48094d2cee60c22d28e07630170

  • SHA1

    75c981b78698a18ec2cdec63229e07e07503f516

  • SHA256

    7dd3e494dd103e9816d02f6254092e82d82deb0f4a2709f4639183ff1b22c8e3

  • SHA512

    babf31c3cf410b60666e762eb6cfdfe56cdd1f80832ae64ec061f0f7a7688f9dcdcc25c7691f9c2927c154cd3551b371dc33dee5db1f3430af4f712415c4ff08

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5P:Rh+ZkldDPK8YaKjP

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      dffaa48094d2cee60c22d28e07630170_NeikiAnalytics

    • Size

      950KB

    • MD5

      dffaa48094d2cee60c22d28e07630170

    • SHA1

      75c981b78698a18ec2cdec63229e07e07503f516

    • SHA256

      7dd3e494dd103e9816d02f6254092e82d82deb0f4a2709f4639183ff1b22c8e3

    • SHA512

      babf31c3cf410b60666e762eb6cfdfe56cdd1f80832ae64ec061f0f7a7688f9dcdcc25c7691f9c2927c154cd3551b371dc33dee5db1f3430af4f712415c4ff08

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5P:Rh+ZkldDPK8YaKjP

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks