revengerat

General

Target

4132868ce09293c0b4d4e241d592d67c062be7faf2cc4b966e9976c9a00ed411
Size

1KB
Sample

220417-tzlt6adfe4
MD5

5b3ffe20f99554d62f8b71ca2553b3fd
SHA1

adf3fd5890b262dde0b51ea34250fba208919cd9
SHA256

4132868ce09293c0b4d4e241d592d67c062be7faf2cc4b966e9976c9a00ed411
SHA512

bbb89687d153896e2eecfa066041d97cc0fd37d9e23e9af34a5cec1107b35706935d233cf2b6fff7925ed11a37c42603a31fb6da97da0ad4d2443e58f18771d5

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://www.uplooder.net/f/tl/14/41a828a1bd32c8f8ce70b7611e62bf05/new-songs.mp3

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

updatefacebook.duckdns.org:6

Mutex

0d00c7b92de94

Targets

- Target
  
  4132868ce09293c0b4d4e241d592d67c062be7faf2cc4b966e9976c9a00ed411
- Size
  
  1KB
- MD5
  
  5b3ffe20f99554d62f8b71ca2553b3fd
- SHA1
  
  adf3fd5890b262dde0b51ea34250fba208919cd9
- SHA256
  
  4132868ce09293c0b4d4e241d592d67c062be7faf2cc4b966e9976c9a00ed411
- SHA512
  
  bbb89687d153896e2eecfa066041d97cc0fd37d9e23e9af34a5cec1107b35706935d233cf2b6fff7925ed11a37c42603a31fb6da97da0ad4d2443e58f18771d5
Score

10^/10

revengerat nyancatrevenge trojan
- RevengeRAT
  Remote-access trojan with a wide range of capabilities.
  trojan revengerat
- Blocklisted process makes network request
- Malicious .NET executables
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Blocklisted process makes network request

Malicious .NET executables

Checks computer location settings

Drops startup file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2