Overview

overview

10

Static

static

5

390d8b8548...cs.exe

windows7-x64

10

390d8b8548...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    390d8b8548c4df169e44bec796a255bfc388fd8a039ef158fe8970c1ca23834c_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240629-akt3fawcqg

  • MD5

    b90c964b1040c2097e6803be9fc2bf20

  • SHA1

    af3605d9b8a17d7afc5a64214bd786fef28b13e1

  • SHA256

    390d8b8548c4df169e44bec796a255bfc388fd8a039ef158fe8970c1ca23834c

  • SHA512

    5e4e59d7d302ee61d1bfa422e080dc1fb40471c1eac041081d7b8a442fe8ed2ee1469e840ca3034bc06c95a111fa5c9fc2a200c773e0d6a665fba6892fc1d554

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT55:Rh+ZkldDPK8YaKj5

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      390d8b8548c4df169e44bec796a255bfc388fd8a039ef158fe8970c1ca23834c_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      b90c964b1040c2097e6803be9fc2bf20

    • SHA1

      af3605d9b8a17d7afc5a64214bd786fef28b13e1

    • SHA256

      390d8b8548c4df169e44bec796a255bfc388fd8a039ef158fe8970c1ca23834c

    • SHA512

      5e4e59d7d302ee61d1bfa422e080dc1fb40471c1eac041081d7b8a442fe8ed2ee1469e840ca3034bc06c95a111fa5c9fc2a200c773e0d6a665fba6892fc1d554

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT55:Rh+ZkldDPK8YaKj5

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks