Overview

overview

10

Static

static

5

10b6eedbab...cs.exe

windows7-x64

10

10b6eedbab...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    10b6eedbab1ec700249b030d4baa5e2a3bdce7c8714d6aba9adaffabbe9119bc_NeikiAnalytics.exe

  • Size

    904KB

  • Sample

    240625-z5tpvawfkp

  • MD5

    a1f3b936f6fbdd285314ec10410be780

  • SHA1

    3d81ecac37519ae695620ed9ae5e004580671dc0

  • SHA256

    10b6eedbab1ec700249b030d4baa5e2a3bdce7c8714d6aba9adaffabbe9119bc

  • SHA512

    7bd8dece90a9856342d8c31784f7eaada7143917bf296ce28a10edc986c124ed0d4df3bc4a935fd64d3ad4b32821836ad7962daba16efc3ab0c7c8a82e420e96

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5v:gh+ZkldoPK8YaKGv

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      10b6eedbab1ec700249b030d4baa5e2a3bdce7c8714d6aba9adaffabbe9119bc_NeikiAnalytics.exe

    • Size

      904KB

    • MD5

      a1f3b936f6fbdd285314ec10410be780

    • SHA1

      3d81ecac37519ae695620ed9ae5e004580671dc0

    • SHA256

      10b6eedbab1ec700249b030d4baa5e2a3bdce7c8714d6aba9adaffabbe9119bc

    • SHA512

      7bd8dece90a9856342d8c31784f7eaada7143917bf296ce28a10edc986c124ed0d4df3bc4a935fd64d3ad4b32821836ad7962daba16efc3ab0c7c8a82e420e96

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5v:gh+ZkldoPK8YaKGv

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks