Overview

overview

10

Static

static

8eaa41284e...b0.exe

windows7_x64

10

8eaa41284e...b0.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8eaa41284ee98eae7e568fed773aee812fe476bf0f798211971dfb5262f9bfb0

  • Size

    69KB

  • Sample

    210228-gbclzheb1j

  • MD5

    aae5b85ac8f341a325e42f9bf76ce086

  • SHA1

    bb857abb794b51227311bb19091b48310e5347bf

  • SHA256

    8eaa41284ee98eae7e568fed773aee812fe476bf0f798211971dfb5262f9bfb0

  • SHA512

    4fd32c9feb4889a5fdef0987be907dad9dafada4dcffee9af7202e9865e541d68b3c07d62edc96998c6d244e29a2aaea398656609124eab9fd2377b291a02352

Score
10/10
revengeratnyancatrevengepersistencetrojan

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

we404.ddns.net:4044

Mutex

e3241919341243fb8

Targets

    • Target

      8eaa41284ee98eae7e568fed773aee812fe476bf0f798211971dfb5262f9bfb0

    • Size

      69KB

    • MD5

      aae5b85ac8f341a325e42f9bf76ce086

    • SHA1

      bb857abb794b51227311bb19091b48310e5347bf

    • SHA256

      8eaa41284ee98eae7e568fed773aee812fe476bf0f798211971dfb5262f9bfb0

    • SHA512

      4fd32c9feb4889a5fdef0987be907dad9dafada4dcffee9af7202e9865e541d68b3c07d62edc96998c6d244e29a2aaea398656609124eab9fd2377b291a02352

    Score
    10/10
    revengeratnyancatrevengepersistencetrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks