Overview

overview

10

Static

static

5

0db0a1c875...cs.exe

windows7-x64

10

0db0a1c875...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0db0a1c875867d0a136bda1dfdb18b3365bc7a9b97c9aa9bc24675607e568180_NeikiAnalytics.exe

  • Size

    903KB

  • Sample

    240701-1vd23ssbrf

  • MD5

    ee4abda808caacb606887c5f157c1850

  • SHA1

    bfbf78f14654e6305e9ffa74c3e4edb72b75f52d

  • SHA256

    0db0a1c875867d0a136bda1dfdb18b3365bc7a9b97c9aa9bc24675607e568180

  • SHA512

    3b7dff3adc474d707fbb88dcdef501f30cc844f7930d31f06f7bbea49f5a313044a96e1dfad0a94bb2e8f0ff523f184da2486c24c0bfb0f0ae3ccf5524cbb20f

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5i:gh+ZkldoPK8YaKGi

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      0db0a1c875867d0a136bda1dfdb18b3365bc7a9b97c9aa9bc24675607e568180_NeikiAnalytics.exe

    • Size

      903KB

    • MD5

      ee4abda808caacb606887c5f157c1850

    • SHA1

      bfbf78f14654e6305e9ffa74c3e4edb72b75f52d

    • SHA256

      0db0a1c875867d0a136bda1dfdb18b3365bc7a9b97c9aa9bc24675607e568180

    • SHA512

      3b7dff3adc474d707fbb88dcdef501f30cc844f7930d31f06f7bbea49f5a313044a96e1dfad0a94bb2e8f0ff523f184da2486c24c0bfb0f0ae3ccf5524cbb20f

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5i:gh+ZkldoPK8YaKGi

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks