Overview

overview

10

Static

static

5

8e9b6b5418...cs.exe

windows7-x64

10

8e9b6b5418...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e9b6b5418742ec2d3fe0d222a7577fe361bc242c9690eb32261480f66f4ee99_NeikiAnalytics.exe

  • Size

    903KB

  • Sample

    240628-kbydlszdmh

  • MD5

    adb4012384b4a27b46e48f8e44d57f60

  • SHA1

    ec129021503efda4f4891e012a33a3c394278c9f

  • SHA256

    8e9b6b5418742ec2d3fe0d222a7577fe361bc242c9690eb32261480f66f4ee99

  • SHA512

    6c6e63dba801ba45dadb8063eb3dc25e96227418f5e566bab78b1b4dcec5db0c39806be7be7980af9f6627fb68a683a52dfcba6902e18e45e3383df00fdd4cd6

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa53:gh+ZkldoPK8YaKG3

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      8e9b6b5418742ec2d3fe0d222a7577fe361bc242c9690eb32261480f66f4ee99_NeikiAnalytics.exe

    • Size

      903KB

    • MD5

      adb4012384b4a27b46e48f8e44d57f60

    • SHA1

      ec129021503efda4f4891e012a33a3c394278c9f

    • SHA256

      8e9b6b5418742ec2d3fe0d222a7577fe361bc242c9690eb32261480f66f4ee99

    • SHA512

      6c6e63dba801ba45dadb8063eb3dc25e96227418f5e566bab78b1b4dcec5db0c39806be7be7980af9f6627fb68a683a52dfcba6902e18e45e3383df00fdd4cd6

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa53:gh+ZkldoPK8YaKG3

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks