Overview

overview

10

Static

static

f3499767b9...dc.exe

windows7_x64

10

f3499767b9...dc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f3499767b9a757f79b6c92df777b9de33ff65b0f8c2f49eda60c6306d4c632dc

  • Size

    282KB

  • Sample

    220326-nq2w5agfhl

  • MD5

    dece6e230754c2dd68b1f6d3c99daec0

  • SHA1

    480a3c2e6cba0b6d8ac1ca43e18406d600ae3065

  • SHA256

    f3499767b9a757f79b6c92df777b9de33ff65b0f8c2f49eda60c6306d4c632dc

  • SHA512

    ffc69eb3396c0187371c28938727bf4900f5890589d7d727298ef2911f663e37ccddefcaf6ec6ac0a22f55ccc0416730e875222bca8a54194e759cadbb93f405

Score
10/10
revengeratnyancatrevengepersistencetrojan

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

xcosgate.ddns.net:2281

Mutex

9bdaf219ee774b13b

Targets

    • Target

      f3499767b9a757f79b6c92df777b9de33ff65b0f8c2f49eda60c6306d4c632dc

    • Size

      282KB

    • MD5

      dece6e230754c2dd68b1f6d3c99daec0

    • SHA1

      480a3c2e6cba0b6d8ac1ca43e18406d600ae3065

    • SHA256

      f3499767b9a757f79b6c92df777b9de33ff65b0f8c2f49eda60c6306d4c632dc

    • SHA512

      ffc69eb3396c0187371c28938727bf4900f5890589d7d727298ef2911f663e37ccddefcaf6ec6ac0a22f55ccc0416730e875222bca8a54194e759cadbb93f405

    Score
    10/10
    revengeratnyancatrevengepersistencetrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks