General

  • Target

    efb9792eac1b723d556fb6162ca33160_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240517-txr86agd23

  • MD5

    efb9792eac1b723d556fb6162ca33160

  • SHA1

    8f295ffd5006f02bc12d85574e1c4088431c308b

  • SHA256

    2883f2ddbe52c39e531572b59065f8fca0d91ccc4b245e315a0c6b5666561c34

  • SHA512

    06fbeb6db74399a704bac36549e8076ba4fd5e3326bb0eaffb6b7d3ce9a9c1acbf137da930e7cfe2617f3b44eaba04fad95a380b8d73d0ec24ab5ad8a5360422

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5J:Rh+ZkldDPK8YaKjJ

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      efb9792eac1b723d556fb6162ca33160_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      efb9792eac1b723d556fb6162ca33160

    • SHA1

      8f295ffd5006f02bc12d85574e1c4088431c308b

    • SHA256

      2883f2ddbe52c39e531572b59065f8fca0d91ccc4b245e315a0c6b5666561c34

    • SHA512

      06fbeb6db74399a704bac36549e8076ba4fd5e3326bb0eaffb6b7d3ce9a9c1acbf137da930e7cfe2617f3b44eaba04fad95a380b8d73d0ec24ab5ad8a5360422

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5J:Rh+ZkldDPK8YaKjJ

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks