Overview

overview

10

Static

static

5

2832b2c804...cs.exe

windows7-x64

10

2832b2c804...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2832b2c804e3ba9175a03d122463456abb04a735dfbb764e32e730bb5fe47892_NeikiAnalytics.exe

  • Size

    904KB

  • Sample

    240702-ctvrfaweqq

  • MD5

    419b96fbf9e1e4dfbe2931b17cc3d590

  • SHA1

    1d6e0f59bc3338001af038fdfc5c0646f5b0323b

  • SHA256

    2832b2c804e3ba9175a03d122463456abb04a735dfbb764e32e730bb5fe47892

  • SHA512

    7ec5466aeb9b325277b600ffa63e60161cc2f92f2bf690a28ace20463eb0a77eac426db048a3afccc504d843b0608102d071d7bbfa4d3a435ff73cc7633d144a

  • SSDEEP

    24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5R:gh+ZkldoPK8YaKGR

Score
10/10
revengeratmarzo26trojan

Malware Config

Extracted

Family

revengerat

Botnet

Marzo26

C2

marzorevenger.duckdns.org:4230

Mutex

RV_MUTEX-PiGGjjtnxDpn

Targets

    • Target

      2832b2c804e3ba9175a03d122463456abb04a735dfbb764e32e730bb5fe47892_NeikiAnalytics.exe

    • Size

      904KB

    • MD5

      419b96fbf9e1e4dfbe2931b17cc3d590

    • SHA1

      1d6e0f59bc3338001af038fdfc5c0646f5b0323b

    • SHA256

      2832b2c804e3ba9175a03d122463456abb04a735dfbb764e32e730bb5fe47892

    • SHA512

      7ec5466aeb9b325277b600ffa63e60161cc2f92f2bf690a28ace20463eb0a77eac426db048a3afccc504d843b0608102d071d7bbfa4d3a435ff73cc7633d144a

    • SSDEEP

      24576:ZAHnh+eWsN3skA4RV1Hom2KXMmHaKZa5R:gh+ZkldoPK8YaKGR

    Score
    10/10
    revengeratmarzo26trojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks