General

  • Target

    0fadfe460748262310d7c59672802290_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240521-1emz2sbb9x

  • MD5

    0fadfe460748262310d7c59672802290

  • SHA1

    e0df9885089f106f7bc655a6cf6787be4ef4c352

  • SHA256

    7fc82ba03d5a34685b7c36e04f8ea33d1debc97f1897752402c63fd9952e4469

  • SHA512

    2a9fce27482665860fdda7f4cab2b803a78d6100a3daa5ed488b4ac4f46c445774ad687b7338a8c76aa640ec4641c0a4d2a56248b62c03a5d91e268f81919ce3

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5o:Rh+ZkldDPK8YaKjo

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      0fadfe460748262310d7c59672802290_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      0fadfe460748262310d7c59672802290

    • SHA1

      e0df9885089f106f7bc655a6cf6787be4ef4c352

    • SHA256

      7fc82ba03d5a34685b7c36e04f8ea33d1debc97f1897752402c63fd9952e4469

    • SHA512

      2a9fce27482665860fdda7f4cab2b803a78d6100a3daa5ed488b4ac4f46c445774ad687b7338a8c76aa640ec4641c0a4d2a56248b62c03a5d91e268f81919ce3

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5o:Rh+ZkldDPK8YaKjo

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks