General

  • Target

    ed7387741906f57d9879d7eec99ea5f0_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240524-s62nhsbc95

  • MD5

    ed7387741906f57d9879d7eec99ea5f0

  • SHA1

    4f87ab8520e23944a13d353a67fe6d867488ca10

  • SHA256

    67fe3b014ebdba68a8cc432fdc62cdbef64fb84a51daab58331a9d0db0035133

  • SHA512

    d66b496862f8a504077cba1d6b7a1b30bee13ac4f914b3dd6b4cc7016b34882738aa87df87d09ae4543a99a69e4d536a707350afe6f3f18cd8c65704f05a7ca4

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5Y:Rh+ZkldDPK8YaKjY

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      ed7387741906f57d9879d7eec99ea5f0_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      ed7387741906f57d9879d7eec99ea5f0

    • SHA1

      4f87ab8520e23944a13d353a67fe6d867488ca10

    • SHA256

      67fe3b014ebdba68a8cc432fdc62cdbef64fb84a51daab58331a9d0db0035133

    • SHA512

      d66b496862f8a504077cba1d6b7a1b30bee13ac4f914b3dd6b4cc7016b34882738aa87df87d09ae4543a99a69e4d536a707350afe6f3f18cd8c65704f05a7ca4

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5Y:Rh+ZkldDPK8YaKjY

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks