General

  • Target

    e4756f52ca30af0206f7713eb1ce5a00_NeikiAnalytics.exe

  • Size

    903KB

  • Sample

    240519-syhknsdb8t

  • MD5

    e4756f52ca30af0206f7713eb1ce5a00

  • SHA1

    3352f52e911a6995db98143b6104c0f29d0314c0

  • SHA256

    05f09d87f4a743350b5b636784001a7edf0dd9f14568f94bb651a2043475c5a0

  • SHA512

    e9ec6f42738d0aaf2c7a387f6e29bf31b15faa1e73bc01355b0ff5ad4db7e27ab1ff5d9ac7b3e7e5c49b83bc0e0b24b43fc20e887c18e259bc5a7154b50edc1c

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5a:gh+ZkldoPK8YaKGa

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      e4756f52ca30af0206f7713eb1ce5a00_NeikiAnalytics.exe

    • Size

      903KB

    • MD5

      e4756f52ca30af0206f7713eb1ce5a00

    • SHA1

      3352f52e911a6995db98143b6104c0f29d0314c0

    • SHA256

      05f09d87f4a743350b5b636784001a7edf0dd9f14568f94bb651a2043475c5a0

    • SHA512

      e9ec6f42738d0aaf2c7a387f6e29bf31b15faa1e73bc01355b0ff5ad4db7e27ab1ff5d9ac7b3e7e5c49b83bc0e0b24b43fc20e887c18e259bc5a7154b50edc1c

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5a:gh+ZkldoPK8YaKGa

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks