General

  • Target

    4fabc70b17f4d37e93957b01aac994bddd3b20e7e8603a0c2d71ba0d12c26c1b_NeikiAnalytics.exe

  • Size

    903KB

  • Sample

    240621-jgkt2avgnq

  • MD5

    80e67ab1fe72a5fa4ac6cb62c28e58a0

  • SHA1

    c9cd8e4cea7666b475a70ba95666e79031a37106

  • SHA256

    4fabc70b17f4d37e93957b01aac994bddd3b20e7e8603a0c2d71ba0d12c26c1b

  • SHA512

    32a852b98b0d94d0c4796f1c423a2b84f92889fb4cb50396d78e67ede70304438de285b260794f03eb9405b5ca6402736e89ad8fdd44bbff791095c3b95bcf7f

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5U:gh+ZkldoPK8YaKGU

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      4fabc70b17f4d37e93957b01aac994bddd3b20e7e8603a0c2d71ba0d12c26c1b_NeikiAnalytics.exe

    • Size

      903KB

    • MD5

      80e67ab1fe72a5fa4ac6cb62c28e58a0

    • SHA1

      c9cd8e4cea7666b475a70ba95666e79031a37106

    • SHA256

      4fabc70b17f4d37e93957b01aac994bddd3b20e7e8603a0c2d71ba0d12c26c1b

    • SHA512

      32a852b98b0d94d0c4796f1c423a2b84f92889fb4cb50396d78e67ede70304438de285b260794f03eb9405b5ca6402736e89ad8fdd44bbff791095c3b95bcf7f

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5U:gh+ZkldoPK8YaKGU

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks