General

  • Target

    8bed34acb4adf0656a8464e6bfafdb00_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240601-d4rm7sha94

  • MD5

    8bed34acb4adf0656a8464e6bfafdb00

  • SHA1

    1f722ae14e9a23e4832f5086d899df0f13ad9f06

  • SHA256

    5eec38977a810d087392e74cd10e776ac4811f95636029151e84fafe863b0511

  • SHA512

    7376e44cd4190c4176bf32a63774532ca95e6406565eea527536f8f16ab249dd5407b04404c0f65d5b9fe94336192a3527152ae014dbf8689ec74e664b77b68d

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT53:Rh+ZkldDPK8YaKj3

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      8bed34acb4adf0656a8464e6bfafdb00_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      8bed34acb4adf0656a8464e6bfafdb00

    • SHA1

      1f722ae14e9a23e4832f5086d899df0f13ad9f06

    • SHA256

      5eec38977a810d087392e74cd10e776ac4811f95636029151e84fafe863b0511

    • SHA512

      7376e44cd4190c4176bf32a63774532ca95e6406565eea527536f8f16ab249dd5407b04404c0f65d5b9fe94336192a3527152ae014dbf8689ec74e664b77b68d

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT53:Rh+ZkldDPK8YaKj3

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks