Overview

overview

10

Static

static

5

b06c1dd489...cs.exe

windows7-x64

10

b06c1dd489...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b06c1dd4896478ab7095aa642acf2060_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240614-j82lvswbpj

  • MD5

    b06c1dd4896478ab7095aa642acf2060

  • SHA1

    55552d1e576d187e785b6b19f940bb2f49400f48

  • SHA256

    febe7a8591631ca153b98445b467457dc6d2099b761e895209f9b2f250fc0b6f

  • SHA512

    86620005f685290c6b22e61aa074e55300286a78198a12dadbb16cfe33453ea964092ba3756386d025a53e74b6459bfe2971fd367d7a6ed2974f4d0978beed73

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5B:Rh+ZkldDPK8YaKjB

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      b06c1dd4896478ab7095aa642acf2060_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      b06c1dd4896478ab7095aa642acf2060

    • SHA1

      55552d1e576d187e785b6b19f940bb2f49400f48

    • SHA256

      febe7a8591631ca153b98445b467457dc6d2099b761e895209f9b2f250fc0b6f

    • SHA512

      86620005f685290c6b22e61aa074e55300286a78198a12dadbb16cfe33453ea964092ba3756386d025a53e74b6459bfe2971fd367d7a6ed2974f4d0978beed73

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5B:Rh+ZkldDPK8YaKjB

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks