Overview

overview

10

Static

static

5

02b879203b...cs.exe

windows7-x64

10

02b879203b...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    02b879203bb10f9107cb14434f3131b8d5533b64896511d2276cfb34443e3ed0_NeikiAnalytics.exe

  • Size

    951KB

  • Sample

    240701-wdwhksvdnn

  • MD5

    886d88a0d51862ce1d514de5428d8260

  • SHA1

    7e332fed48e96f8b7a59fb567ddf2ae86cd6d299

  • SHA256

    02b879203bb10f9107cb14434f3131b8d5533b64896511d2276cfb34443e3ed0

  • SHA512

    72ea6e4327741208f049913c9a7c3499330db9b9de4f9061807092c40bf5e04b426464b53c1d3a2882f191811e5963d08a385e7acecadeed39bfe184130e938a

  • SSDEEP

    24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5h:Rh+ZkldDPK8YaKjh

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      02b879203bb10f9107cb14434f3131b8d5533b64896511d2276cfb34443e3ed0_NeikiAnalytics.exe

    • Size

      951KB

    • MD5

      886d88a0d51862ce1d514de5428d8260

    • SHA1

      7e332fed48e96f8b7a59fb567ddf2ae86cd6d299

    • SHA256

      02b879203bb10f9107cb14434f3131b8d5533b64896511d2276cfb34443e3ed0

    • SHA512

      72ea6e4327741208f049913c9a7c3499330db9b9de4f9061807092c40bf5e04b426464b53c1d3a2882f191811e5963d08a385e7acecadeed39bfe184130e938a

    • SSDEEP

      24576:2AHnh+eWsN3skA4RV1HDm2KXMmHaKZT5h:Rh+ZkldDPK8YaKjh

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks