General

  • Target

    e83c7228613e1b076ec88171f58ebe90_NeikiAnalytics.exe

  • Size

    903KB

  • Sample

    240519-s7tz3adg8t

  • MD5

    e83c7228613e1b076ec88171f58ebe90

  • SHA1

    2fb4ce9b61174fdce11112179e715b80ea5625db

  • SHA256

    54f07a32df3a785075b33874b7e63bb46ca8c27c957bd62ddc0aea05889c20c1

  • SHA512

    3d875bf260e245fad5a29418ef31387f1e95de43cad1235660cfcde00363b06cac6260f26e8565e1372ad20f05afcf3a3adcd0527177e3b940885f636f887247

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5T:gh+ZkldoPK8YaKGT

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      e83c7228613e1b076ec88171f58ebe90_NeikiAnalytics.exe

    • Size

      903KB

    • MD5

      e83c7228613e1b076ec88171f58ebe90

    • SHA1

      2fb4ce9b61174fdce11112179e715b80ea5625db

    • SHA256

      54f07a32df3a785075b33874b7e63bb46ca8c27c957bd62ddc0aea05889c20c1

    • SHA512

      3d875bf260e245fad5a29418ef31387f1e95de43cad1235660cfcde00363b06cac6260f26e8565e1372ad20f05afcf3a3adcd0527177e3b940885f636f887247

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5T:gh+ZkldoPK8YaKGT

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks