General

  • Target

    76fdde97284d100ce13186f522eea500_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240526-gnq9aahb7w

  • MD5

    76fdde97284d100ce13186f522eea500

  • SHA1

    76202c4124aecc61a3f308f8bf8834496815cb08

  • SHA256

    dbacac9baa48e7b7ed25d5a5c82ae37daecaee4356832f4b05392a1bb12ac4a5

  • SHA512

    5d3d86866462474546b25943be978949a45fb61c157b14cb62201dade20a692e407cf5b5331769f73ac97c06255b0d7c319876c75fb45714535bbbed59377bfd

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5t:Rh+ZkldDPK8YaKjt

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      76fdde97284d100ce13186f522eea500_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      76fdde97284d100ce13186f522eea500

    • SHA1

      76202c4124aecc61a3f308f8bf8834496815cb08

    • SHA256

      dbacac9baa48e7b7ed25d5a5c82ae37daecaee4356832f4b05392a1bb12ac4a5

    • SHA512

      5d3d86866462474546b25943be978949a45fb61c157b14cb62201dade20a692e407cf5b5331769f73ac97c06255b0d7c319876c75fb45714535bbbed59377bfd

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5t:Rh+ZkldDPK8YaKjt

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks