Overview

overview

10

Static

static

5

6f855977f4...cs.exe

windows7-x64

10

6f855977f4...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240626-kj465aycrk

  • MD5

    fcf77222c8865f407c22623e23e5c010

  • SHA1

    a2f35c3ff7372415ae70368b68b7cfef3f958150

  • SHA256

    6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210

  • SHA512

    1e1b99876ce841cb0feaea89f079e101b8beaf0b961b29ef4b4bc182b5e7acf22d2ce5e305b7408af3616b8c0011d6de7ce5eb4c1e0788758b57eb5674859251

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5e:Rh+ZkldDPK8YaKje

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      fcf77222c8865f407c22623e23e5c010

    • SHA1

      a2f35c3ff7372415ae70368b68b7cfef3f958150

    • SHA256

      6f855977f4e1a527b45c597fa95ff713fb970dcef4474b2600ca5560f7546210

    • SHA512

      1e1b99876ce841cb0feaea89f079e101b8beaf0b961b29ef4b4bc182b5e7acf22d2ce5e305b7408af3616b8c0011d6de7ce5eb4c1e0788758b57eb5674859251

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5e:Rh+ZkldDPK8YaKje

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks