General

  • Target

    2671d510eb9b2a9da2312e07ce28ae10_NeikiAnalytics.exe

  • Size

    903KB

  • Sample

    240525-ph47ysah24

  • MD5

    2671d510eb9b2a9da2312e07ce28ae10

  • SHA1

    79e2b2d719b3b2f4d8d38773825e1e2f8a169b9b

  • SHA256

    b090a7546e555332d2319d856a96469726cf2f018a31d6e22a39d26af2674f2a

  • SHA512

    c5b0ca43f681865524762a21ff5343a11065dadfb1961e5f8d349ef43034002554aa633bdf52348b80e1c55e572806a78002dfb2a006d9c8ab9055eaaa705762

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5e:gh+ZkldoPK8YaKGe

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      2671d510eb9b2a9da2312e07ce28ae10_NeikiAnalytics.exe

    • Size

      903KB

    • MD5

      2671d510eb9b2a9da2312e07ce28ae10

    • SHA1

      79e2b2d719b3b2f4d8d38773825e1e2f8a169b9b

    • SHA256

      b090a7546e555332d2319d856a96469726cf2f018a31d6e22a39d26af2674f2a

    • SHA512

      c5b0ca43f681865524762a21ff5343a11065dadfb1961e5f8d349ef43034002554aa633bdf52348b80e1c55e572806a78002dfb2a006d9c8ab9055eaaa705762

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5e:gh+ZkldoPK8YaKGe

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks