Overview

overview

10

Static

static

5

2fe7960b66...cs.exe

windows7-x64

10

2fe7960b66...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2fe7960b6622da5cf559f4c132913f121716b70e4dce1cc14d9a86fe2b5135d7_NeikiAnalytics.exe

  • Size

    903KB

  • Sample

    240623-dal6ma1bjq

  • MD5

    4ab1836b7679c44f55b0e89affdd54e0

  • SHA1

    ae4fb0581b0d2c76e2d8e8c9c43af5e8de4faa14

  • SHA256

    2fe7960b6622da5cf559f4c132913f121716b70e4dce1cc14d9a86fe2b5135d7

  • SHA512

    798b5100461252ef1b21a8ad43b3318dda358de9ee1f90dc2c256ab9915f918295526c110e0dfe584082a858d3285b3b5e40e315344b7b83202a730d017ea617

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5/:gh+ZkldoPK8YaKG/

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      2fe7960b6622da5cf559f4c132913f121716b70e4dce1cc14d9a86fe2b5135d7_NeikiAnalytics.exe

    • Size

      903KB

    • MD5

      4ab1836b7679c44f55b0e89affdd54e0

    • SHA1

      ae4fb0581b0d2c76e2d8e8c9c43af5e8de4faa14

    • SHA256

      2fe7960b6622da5cf559f4c132913f121716b70e4dce1cc14d9a86fe2b5135d7

    • SHA512

      798b5100461252ef1b21a8ad43b3318dda358de9ee1f90dc2c256ab9915f918295526c110e0dfe584082a858d3285b3b5e40e315344b7b83202a730d017ea617

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5/:gh+ZkldoPK8YaKG/

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks