Overview

overview

10

Static

static

5

b2b9c05240...cs.exe

windows7-x64

10

b2b9c05240...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b2b9c05240cf93c0e87f92370642f59a3df09d968e860a6bf90cf393af1c1e05_NeikiAnalytics.exe

  • Size

    903KB

  • Sample

    240629-tn8jsatfrk

  • MD5

    4314527b3a6bebd5ec8dd14f4fed5690

  • SHA1

    13d8ab93929f6649054b4553af2f7bb10cf9fc33

  • SHA256

    b2b9c05240cf93c0e87f92370642f59a3df09d968e860a6bf90cf393af1c1e05

  • SHA512

    1bc49a32fbd04f7365ffc391c620d22eed451ceb1f7f538c7dce810682c6e37584c8388143c9cbb21df356c9440448f401be608bff4239b5c56b802d8468a0e1

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5s:gh+ZkldoPK8YaKGs

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      b2b9c05240cf93c0e87f92370642f59a3df09d968e860a6bf90cf393af1c1e05_NeikiAnalytics.exe

    • Size

      903KB

    • MD5

      4314527b3a6bebd5ec8dd14f4fed5690

    • SHA1

      13d8ab93929f6649054b4553af2f7bb10cf9fc33

    • SHA256

      b2b9c05240cf93c0e87f92370642f59a3df09d968e860a6bf90cf393af1c1e05

    • SHA512

      1bc49a32fbd04f7365ffc391c620d22eed451ceb1f7f538c7dce810682c6e37584c8388143c9cbb21df356c9440448f401be608bff4239b5c56b802d8468a0e1

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5s:gh+ZkldoPK8YaKGs

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks