Overview

overview

10

Static

static

5

36729f1e0e...cs.exe

windows7-x64

10

36729f1e0e...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    36729f1e0e8499475a96ecd7613f721a87dbaade5df54be236090c58e2bcaeef_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240627-byfbwawakb

  • MD5

    ea05e419ae9c90142cd79e9593022db0

  • SHA1

    4f9d9fb05fc053118867d8760666940438b7b39e

  • SHA256

    36729f1e0e8499475a96ecd7613f721a87dbaade5df54be236090c58e2bcaeef

  • SHA512

    8aadb8e55659e77d70c5b433f2cf5a5a79fb89acfdcb3887978bf93adf8e99a2c774375f710e4a61e4bffeecdd3633999c67eb4bf7e2eb02c6c2014f38d274c6

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5W:Rh+ZkldDPK8YaKjW

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      36729f1e0e8499475a96ecd7613f721a87dbaade5df54be236090c58e2bcaeef_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      ea05e419ae9c90142cd79e9593022db0

    • SHA1

      4f9d9fb05fc053118867d8760666940438b7b39e

    • SHA256

      36729f1e0e8499475a96ecd7613f721a87dbaade5df54be236090c58e2bcaeef

    • SHA512

      8aadb8e55659e77d70c5b433f2cf5a5a79fb89acfdcb3887978bf93adf8e99a2c774375f710e4a61e4bffeecdd3633999c67eb4bf7e2eb02c6c2014f38d274c6

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5W:Rh+ZkldDPK8YaKjW

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks