Overview

overview

10

Static

static

5

8cd631253f...cs.exe

windows7-x64

10

8cd631253f...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8cd631253f8f8af232883189c2e46598b3e92e52c2a17eb820d27fe2cc271fac_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240622-ky38dasdjb

  • MD5

    c99a597710fcba72d00c95c432b2ef00

  • SHA1

    2b01b34253e6951c82e0af53d716744130819ade

  • SHA256

    8cd631253f8f8af232883189c2e46598b3e92e52c2a17eb820d27fe2cc271fac

  • SHA512

    ff28d0d8ad19ed3f667714f1e55ffd19f19213169b5f33f6203f35ac5b086a89da8bd4e6291e780aa571dfa3a42798b5727f58f261ca890378662682eb736ff7

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5W:Rh+ZkldDPK8YaKjW

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      8cd631253f8f8af232883189c2e46598b3e92e52c2a17eb820d27fe2cc271fac_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      c99a597710fcba72d00c95c432b2ef00

    • SHA1

      2b01b34253e6951c82e0af53d716744130819ade

    • SHA256

      8cd631253f8f8af232883189c2e46598b3e92e52c2a17eb820d27fe2cc271fac

    • SHA512

      ff28d0d8ad19ed3f667714f1e55ffd19f19213169b5f33f6203f35ac5b086a89da8bd4e6291e780aa571dfa3a42798b5727f58f261ca890378662682eb736ff7

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5W:Rh+ZkldDPK8YaKjW

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks