General

  • Target

    23040670138aa912f99aa02ed1ced060_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240523-eqpgcsde58

  • MD5

    23040670138aa912f99aa02ed1ced060

  • SHA1

    b075c143e310a2b4b7199bd061b95850562337a4

  • SHA256

    de6d1cb381fdcbf0b571f691e5a589c2781645d319e26df462592794b4a486d5

  • SHA512

    41c5e704ff484767dea29ac11ca3b1ef42a0a02529c9658d8fa8b7ccf3cef535439d1f120608d2354894978481e1174fe321fcf02d37627763d0d9bbabdab4d0

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5w:Rh+ZkldDPK8YaKjw

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      23040670138aa912f99aa02ed1ced060_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      23040670138aa912f99aa02ed1ced060

    • SHA1

      b075c143e310a2b4b7199bd061b95850562337a4

    • SHA256

      de6d1cb381fdcbf0b571f691e5a589c2781645d319e26df462592794b4a486d5

    • SHA512

      41c5e704ff484767dea29ac11ca3b1ef42a0a02529c9658d8fa8b7ccf3cef535439d1f120608d2354894978481e1174fe321fcf02d37627763d0d9bbabdab4d0

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5w:Rh+ZkldDPK8YaKjw

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks