General

  • Target

    1427cdbcbf101cc5fd0a3f2305bd1400_NeikiAnalytics.exe

  • Size

    903KB

  • Sample

    240616-2b4n3a1clf

  • MD5

    1427cdbcbf101cc5fd0a3f2305bd1400

  • SHA1

    9e44e4cda7232fcc737e9756addc37163f5681ef

  • SHA256

    4ba967039aa700ba2822d0733e9f3aa081e2b2fec037dbb0df35a775faf3cf46

  • SHA512

    418142e6a9a388a7ac139a6b1d03bc37b9d9b3ec15d2f06b3bfcb8e938e4b0abfc6c46fc6da40f7c5ae909bd859f11b800d78a03d5efb146b0045b6fe3905571

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5x:gh+ZkldoPK8YaKGx

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      1427cdbcbf101cc5fd0a3f2305bd1400_NeikiAnalytics.exe

    • Size

      903KB

    • MD5

      1427cdbcbf101cc5fd0a3f2305bd1400

    • SHA1

      9e44e4cda7232fcc737e9756addc37163f5681ef

    • SHA256

      4ba967039aa700ba2822d0733e9f3aa081e2b2fec037dbb0df35a775faf3cf46

    • SHA512

      418142e6a9a388a7ac139a6b1d03bc37b9d9b3ec15d2f06b3bfcb8e938e4b0abfc6c46fc6da40f7c5ae909bd859f11b800d78a03d5efb146b0045b6fe3905571

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5x:gh+ZkldoPK8YaKGx

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks