Overview

overview

10

Static

static

5

60d617f80c...cs.exe

windows7-x64

10

60d617f80c...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    60d617f80c2bedb9774d5f51281792b9b32d24c0351e24115d122287b0826266_NeikiAnalytics.exe

  • Size

    903KB

  • Sample

    240623-mgt99aybrd

  • MD5

    5ce8e5812cf0db1f48fd176831b5a450

  • SHA1

    784569028cf99b9acc03157b23a4000ab3baea10

  • SHA256

    60d617f80c2bedb9774d5f51281792b9b32d24c0351e24115d122287b0826266

  • SHA512

    0a46eb3662c54181fb6251f1c433733801b06f892e9e7e0e81d61cc77563f348dbc1df865c6e536b336a2d5515ed8ac116b644c3fead99a2e2bb1d50c2daea0c

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5Y:gh+ZkldoPK8YaKGY

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      60d617f80c2bedb9774d5f51281792b9b32d24c0351e24115d122287b0826266_NeikiAnalytics.exe

    • Size

      903KB

    • MD5

      5ce8e5812cf0db1f48fd176831b5a450

    • SHA1

      784569028cf99b9acc03157b23a4000ab3baea10

    • SHA256

      60d617f80c2bedb9774d5f51281792b9b32d24c0351e24115d122287b0826266

    • SHA512

      0a46eb3662c54181fb6251f1c433733801b06f892e9e7e0e81d61cc77563f348dbc1df865c6e536b336a2d5515ed8ac116b644c3fead99a2e2bb1d50c2daea0c

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5Y:gh+ZkldoPK8YaKGY

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks