General

  • Target

    b6c425ab8a4db1b848ceceb8cd6554b0_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240520-fyyknsdc93

  • MD5

    b6c425ab8a4db1b848ceceb8cd6554b0

  • SHA1

    80d52ec65ec15a16a639853be2291989c4928a25

  • SHA256

    0f4c9b1ad1ea114a3f2d64bff1443db00e99b5701579a15fa50157f282d80b37

  • SHA512

    ac0cfc6037a1e09608f5648791e18960fb1e46dd4b0c2cecf5949ec52e442726bb17f08e2649a0342a2b217779aaf7e6c37a8da7f53e39b08211fe76c3783e35

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5B:Rh+ZkldDPK8YaKjB

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      b6c425ab8a4db1b848ceceb8cd6554b0_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      b6c425ab8a4db1b848ceceb8cd6554b0

    • SHA1

      80d52ec65ec15a16a639853be2291989c4928a25

    • SHA256

      0f4c9b1ad1ea114a3f2d64bff1443db00e99b5701579a15fa50157f282d80b37

    • SHA512

      ac0cfc6037a1e09608f5648791e18960fb1e46dd4b0c2cecf5949ec52e442726bb17f08e2649a0342a2b217779aaf7e6c37a8da7f53e39b08211fe76c3783e35

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5B:Rh+ZkldDPK8YaKjB

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks