General

  • Target

    1e9cfba1ebcfa4e5dc48d0f05d4882e43f9141ada7e149a69082202a7fa24aa2_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240620-3pzspssfjg

  • MD5

    44e927b5202de2ccb6b19dcd98d58fc0

  • SHA1

    8b7ee33572e407dcd1aa2cbfafd2b5e9352a3308

  • SHA256

    1e9cfba1ebcfa4e5dc48d0f05d4882e43f9141ada7e149a69082202a7fa24aa2

  • SHA512

    0ff12dfa89e7cb52d306122add431ddb7fe02cfb9c463f831610bdce7c1e77780db3f267cebbbf8841347341eb3ba702daa024b7dd94d3c5b98935339cad28ea

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5L:Rh+ZkldDPK8YaKjL

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      1e9cfba1ebcfa4e5dc48d0f05d4882e43f9141ada7e149a69082202a7fa24aa2_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      44e927b5202de2ccb6b19dcd98d58fc0

    • SHA1

      8b7ee33572e407dcd1aa2cbfafd2b5e9352a3308

    • SHA256

      1e9cfba1ebcfa4e5dc48d0f05d4882e43f9141ada7e149a69082202a7fa24aa2

    • SHA512

      0ff12dfa89e7cb52d306122add431ddb7fe02cfb9c463f831610bdce7c1e77780db3f267cebbbf8841347341eb3ba702daa024b7dd94d3c5b98935339cad28ea

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5L:Rh+ZkldDPK8YaKjL

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks