Overview

overview

10

Static

static

5

69a33fe2d7...cs.exe

windows7-x64

10

69a33fe2d7...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    69a33fe2d7831182d5343cbbc9ec55b7773160e2f237d63881a33f5141f1e0f6_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240626-jrpkzawgkl

  • MD5

    fc46ee6f39e1b7d516f63fa252143660

  • SHA1

    664b8cced7496db4f45133567912f1643f0445b3

  • SHA256

    69a33fe2d7831182d5343cbbc9ec55b7773160e2f237d63881a33f5141f1e0f6

  • SHA512

    eef37011b49e70f27c8e5808f3df7bfa247bd8fbdda3a37dd180913a99b955fe305f75441a3044e101036f58495970a2e7185e27ceebfb4eb05103fafcddc7c4

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT53:Rh+ZkldDPK8YaKj3

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      69a33fe2d7831182d5343cbbc9ec55b7773160e2f237d63881a33f5141f1e0f6_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      fc46ee6f39e1b7d516f63fa252143660

    • SHA1

      664b8cced7496db4f45133567912f1643f0445b3

    • SHA256

      69a33fe2d7831182d5343cbbc9ec55b7773160e2f237d63881a33f5141f1e0f6

    • SHA512

      eef37011b49e70f27c8e5808f3df7bfa247bd8fbdda3a37dd180913a99b955fe305f75441a3044e101036f58495970a2e7185e27ceebfb4eb05103fafcddc7c4

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT53:Rh+ZkldDPK8YaKj3

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks