General

  • Target

    1c4bdf41d41d96bd8d9462c6c70b8660_NeikiAnalytics.exe

  • Size

    903KB

  • Sample

    240616-3dsv1sxdpk

  • MD5

    1c4bdf41d41d96bd8d9462c6c70b8660

  • SHA1

    50778137f1c0ab66d5984a82b14a4a22d0c2d0c3

  • SHA256

    3e2c73ac59f1b9b13a84b4f305908f9cbbe04ab35506663353507916fc4947e9

  • SHA512

    dfca78fd1a3ed9b9e76adcb8c223843222985e7495b1d8ca7a7f20c90ed58046fb274c370aece399687b5640a75313a13d22a6c2ebf75688b4da75247092a8fb

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa59:gh+ZkldoPK8YaKG9

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      1c4bdf41d41d96bd8d9462c6c70b8660_NeikiAnalytics.exe

    • Size

      903KB

    • MD5

      1c4bdf41d41d96bd8d9462c6c70b8660

    • SHA1

      50778137f1c0ab66d5984a82b14a4a22d0c2d0c3

    • SHA256

      3e2c73ac59f1b9b13a84b4f305908f9cbbe04ab35506663353507916fc4947e9

    • SHA512

      dfca78fd1a3ed9b9e76adcb8c223843222985e7495b1d8ca7a7f20c90ed58046fb274c370aece399687b5640a75313a13d22a6c2ebf75688b4da75247092a8fb

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa59:gh+ZkldoPK8YaKG9

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks