General

  • Target

    5954a02b575c718489b136ead1c54d20_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240526-dpvrbacg7s

  • MD5

    5954a02b575c718489b136ead1c54d20

  • SHA1

    1fc5b06b18520057b884e22a0f696d9f8d6bd83a

  • SHA256

    d384defab9b2ea94286e9710639517958854ba8b9b11cfb8b07798c12013ad63

  • SHA512

    8b76e150ba6aaebcb5d5a0dc9626ecee4cfbdb981b42ee5a1f9f5a0c0e71218ad70289dfdb61beef9e802036a55c800ca9dbac0bdbbfae87831a7153607ffd67

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5G:Rh+ZkldDPK8YaKjG

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      5954a02b575c718489b136ead1c54d20_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      5954a02b575c718489b136ead1c54d20

    • SHA1

      1fc5b06b18520057b884e22a0f696d9f8d6bd83a

    • SHA256

      d384defab9b2ea94286e9710639517958854ba8b9b11cfb8b07798c12013ad63

    • SHA512

      8b76e150ba6aaebcb5d5a0dc9626ecee4cfbdb981b42ee5a1f9f5a0c0e71218ad70289dfdb61beef9e802036a55c800ca9dbac0bdbbfae87831a7153607ffd67

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5G:Rh+ZkldDPK8YaKjG

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks