General

  • Target

    a072dfbb75356de838ebc07e403f4e50_NeikiAnalytics.exe

  • Size

    903KB

  • Sample

    240518-gyl3bafc57

  • MD5

    a072dfbb75356de838ebc07e403f4e50

  • SHA1

    0bbd06cd0a16182ebeae6ea90cfbd6c942817dac

  • SHA256

    3a2ff3f262e279e984b2662ead2e469f2d21d4d38c13c4dbfedba843981857d4

  • SHA512

    141e257d719ebcfbc007d09ff6573541ef1bf237f017ac1465f91b2b6234a9368a8ee933ef49e70ce35fdc4b95a9efd69074dee01d00366aeb593b5eb8769d0f

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5A:gh+ZkldoPK8YaKGA

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      a072dfbb75356de838ebc07e403f4e50_NeikiAnalytics.exe

    • Size

      903KB

    • MD5

      a072dfbb75356de838ebc07e403f4e50

    • SHA1

      0bbd06cd0a16182ebeae6ea90cfbd6c942817dac

    • SHA256

      3a2ff3f262e279e984b2662ead2e469f2d21d4d38c13c4dbfedba843981857d4

    • SHA512

      141e257d719ebcfbc007d09ff6573541ef1bf237f017ac1465f91b2b6234a9368a8ee933ef49e70ce35fdc4b95a9efd69074dee01d00366aeb593b5eb8769d0f

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5A:gh+ZkldoPK8YaKGA

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks