Overview

overview

10

Static

static

5

618692a51e...cs.exe

windows7-x64

10

618692a51e...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    618692a51e4188822e9cee7608f7d3e0_NeikiAnalytics.exe

  • Size

    903KB

  • Sample

    240523-ap36xaef3z

  • MD5

    618692a51e4188822e9cee7608f7d3e0

  • SHA1

    c7bde7058b2628d5fd0bf1d9424eb6632886bf1a

  • SHA256

    791efaf4b488a4e77f0a5951433bc1d295b7a3ac377ade669e804b111c6c5fbe

  • SHA512

    75805795a40d94c61298b1ff879aa35fae0facbc9335047b67fc517926c77c862b2e4031ae80d305a751fb5b0aa466d2d93bb5e14a26ca7a10828a37e00a874a

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa52:gh+ZkldoPK8YaKG2

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      618692a51e4188822e9cee7608f7d3e0_NeikiAnalytics.exe

    • Size

      903KB

    • MD5

      618692a51e4188822e9cee7608f7d3e0

    • SHA1

      c7bde7058b2628d5fd0bf1d9424eb6632886bf1a

    • SHA256

      791efaf4b488a4e77f0a5951433bc1d295b7a3ac377ade669e804b111c6c5fbe

    • SHA512

      75805795a40d94c61298b1ff879aa35fae0facbc9335047b67fc517926c77c862b2e4031ae80d305a751fb5b0aa466d2d93bb5e14a26ca7a10828a37e00a874a

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa52:gh+ZkldoPK8YaKG2

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks