Overview

overview

10

Static

static

5

6ca2c6b4a6...cs.exe

windows7-x64

10

6ca2c6b4a6...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6ca2c6b4a650b430bb1b5269500b8b81c8331c00c3153925d0a9fd1ffbe64139_NeikiAnalytics.exe

  • Size

    903KB

  • Sample

    240626-j7ka7axfjr

  • MD5

    ab33e2c19b1f1778a52a27dbd17648a0

  • SHA1

    306033d00bd7b3cdde21f8dc43271c6309ccce90

  • SHA256

    6ca2c6b4a650b430bb1b5269500b8b81c8331c00c3153925d0a9fd1ffbe64139

  • SHA512

    6c27430d893938de5c53c9465e99baa547060d887d20dd965f388a7c9f966fd622cef1f029c92cba04759cfe88d9735bb9b9e1cd6832df0314e8e1108850c274

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5n:gh+ZkldoPK8YaKGn

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      6ca2c6b4a650b430bb1b5269500b8b81c8331c00c3153925d0a9fd1ffbe64139_NeikiAnalytics.exe

    • Size

      903KB

    • MD5

      ab33e2c19b1f1778a52a27dbd17648a0

    • SHA1

      306033d00bd7b3cdde21f8dc43271c6309ccce90

    • SHA256

      6ca2c6b4a650b430bb1b5269500b8b81c8331c00c3153925d0a9fd1ffbe64139

    • SHA512

      6c27430d893938de5c53c9465e99baa547060d887d20dd965f388a7c9f966fd622cef1f029c92cba04759cfe88d9735bb9b9e1cd6832df0314e8e1108850c274

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5n:gh+ZkldoPK8YaKGn

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks