Overview

overview

10

Static

static

5

3ebba57079...cs.exe

windows7-x64

10

3ebba57079...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3ebba57079bf3aace31f91c61cdac9d635ecc01691f6ec49c30d95549aeb6c6d_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240701-h1eaxsscqr

  • MD5

    0678e0cc60fbb9cc92b4b8ca13431890

  • SHA1

    36c55e4ae2010cb4c360f8869967d4a6b35d5bde

  • SHA256

    3ebba57079bf3aace31f91c61cdac9d635ecc01691f6ec49c30d95549aeb6c6d

  • SHA512

    a2546f48c3273afd195bb51321d653378980aa5f284310bac566052dcac347bbb93a276fcf2bda5737803ed573e0919bce13af340f904f782e0c9999f81aa32e

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT54:Rh+ZkldDPK8YaKj4

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      3ebba57079bf3aace31f91c61cdac9d635ecc01691f6ec49c30d95549aeb6c6d_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      0678e0cc60fbb9cc92b4b8ca13431890

    • SHA1

      36c55e4ae2010cb4c360f8869967d4a6b35d5bde

    • SHA256

      3ebba57079bf3aace31f91c61cdac9d635ecc01691f6ec49c30d95549aeb6c6d

    • SHA512

      a2546f48c3273afd195bb51321d653378980aa5f284310bac566052dcac347bbb93a276fcf2bda5737803ed573e0919bce13af340f904f782e0c9999f81aa32e

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT54:Rh+ZkldDPK8YaKj4

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks