General

  • Target

    ac7554a8bd5eb90ba5b09a9f0554e6b0_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240519-kbtenaae66

  • MD5

    ac7554a8bd5eb90ba5b09a9f0554e6b0

  • SHA1

    5931ddee7be91b433fbc00d93d91169d599cabcb

  • SHA256

    2a2a3ced04f2550c4d5ec9766a0f103215e50f3081ecec4f95ccf2e8421131be

  • SHA512

    79f1c2cd5e67e55d7a69eeefda95e334f6dc01b99e9982045df6a43a7087b63d1c62dc420c5a78aa9760b7db5dd02ab1a519911f6ee117b5cb33aa9e11de48b0

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5O:Rh+ZkldDPK8YaKjO

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      ac7554a8bd5eb90ba5b09a9f0554e6b0_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      ac7554a8bd5eb90ba5b09a9f0554e6b0

    • SHA1

      5931ddee7be91b433fbc00d93d91169d599cabcb

    • SHA256

      2a2a3ced04f2550c4d5ec9766a0f103215e50f3081ecec4f95ccf2e8421131be

    • SHA512

      79f1c2cd5e67e55d7a69eeefda95e334f6dc01b99e9982045df6a43a7087b63d1c62dc420c5a78aa9760b7db5dd02ab1a519911f6ee117b5cb33aa9e11de48b0

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5O:Rh+ZkldDPK8YaKjO

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks