General

  • Target

    2656c34dd1f93e90ea90f265b9f02820_NeikiAnalytics.exe

  • Size

    903KB

  • Sample

    240527-27gjeaef97

  • MD5

    2656c34dd1f93e90ea90f265b9f02820

  • SHA1

    06ae78e8b93beeed306b4daf52326453196441f8

  • SHA256

    047235ba9e9d7c8992f8949749cd1ea834dad58359c849d54862bd8da7e8a0b2

  • SHA512

    a423a07ab279f5dd7d5e9d0844b356bbb9a7b807d0335389394c00a0230e88d04e96e64b659920fb99c653e07b897e38073ebebc3748eb3ba2f5f6159538b7f4

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5p:gh+ZkldoPK8YaKGp

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      2656c34dd1f93e90ea90f265b9f02820_NeikiAnalytics.exe

    • Size

      903KB

    • MD5

      2656c34dd1f93e90ea90f265b9f02820

    • SHA1

      06ae78e8b93beeed306b4daf52326453196441f8

    • SHA256

      047235ba9e9d7c8992f8949749cd1ea834dad58359c849d54862bd8da7e8a0b2

    • SHA512

      a423a07ab279f5dd7d5e9d0844b356bbb9a7b807d0335389394c00a0230e88d04e96e64b659920fb99c653e07b897e38073ebebc3748eb3ba2f5f6159538b7f4

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5p:gh+ZkldoPK8YaKGp

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks