Overview

overview

10

Static

static

f9a9a3d9a0...2b.exe

windows7_x64

3

f9a9a3d9a0...2b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9a9a3d9a05659903c55f793e8b5cc34455da1994e5b6fb4747b1d661a4f5e2b

  • Size

    207KB

  • Sample

    220502-cwqv9saag8

  • MD5

    baab6b920f71c23fad1133d8e57aa215

  • SHA1

    af630b8a873326645751c9fba78de715d91ae211

  • SHA256

    f9a9a3d9a05659903c55f793e8b5cc34455da1994e5b6fb4747b1d661a4f5e2b

  • SHA512

    7147023f94a01eada51170916a33da140224b514c6da71bc59cee0afa531fd9086a86f053e10c07e1a597edae39f163ea89f7eef86f69701ca676d49d089e889

Score
10/10
revengeratnyancatrevengeevasionpersistencetrojan

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

hpdndbnb.duckdns.org:2404

Mutex

90a49aa7c27647e

Targets

    • Target

      f9a9a3d9a05659903c55f793e8b5cc34455da1994e5b6fb4747b1d661a4f5e2b

    • Size

      207KB

    • MD5

      baab6b920f71c23fad1133d8e57aa215

    • SHA1

      af630b8a873326645751c9fba78de715d91ae211

    • SHA256

      f9a9a3d9a05659903c55f793e8b5cc34455da1994e5b6fb4747b1d661a4f5e2b

    • SHA512

      7147023f94a01eada51170916a33da140224b514c6da71bc59cee0afa531fd9086a86f053e10c07e1a597edae39f163ea89f7eef86f69701ca676d49d089e889

    Score
    10/10
    revengeratnyancatrevengeevasionpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Turns off Windows Defender SpyNet reporting

      evasion

    • Windows security bypass

      evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

6
T1112

Disabling Security Tools

4
T1089

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks