Overview

overview

10

Static

static

5

7ab2008f22...cs.exe

windows7-x64

10

7ab2008f22...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ab2008f22c89dfea9dc27886d7046eb8e23d736b5b6aa707497f28073b0e21c_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240627-l7w14aycjq

  • MD5

    29c5ff18782054b3a7854aab92770820

  • SHA1

    4155ab6132a08c9490b9f83c1fc599dad72bc661

  • SHA256

    7ab2008f22c89dfea9dc27886d7046eb8e23d736b5b6aa707497f28073b0e21c

  • SHA512

    bf4deacdef56cfd404524930459bfa680c4f74b7be2615e78b067581174cf173dd2b5858bcec3a2c8fc6106f8446f2d568eac7d4725ee88c5c1ebd59dad5111c

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5D:Rh+ZkldDPK8YaKjD

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      7ab2008f22c89dfea9dc27886d7046eb8e23d736b5b6aa707497f28073b0e21c_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      29c5ff18782054b3a7854aab92770820

    • SHA1

      4155ab6132a08c9490b9f83c1fc599dad72bc661

    • SHA256

      7ab2008f22c89dfea9dc27886d7046eb8e23d736b5b6aa707497f28073b0e21c

    • SHA512

      bf4deacdef56cfd404524930459bfa680c4f74b7be2615e78b067581174cf173dd2b5858bcec3a2c8fc6106f8446f2d568eac7d4725ee88c5c1ebd59dad5111c

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5D:Rh+ZkldDPK8YaKjD

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks