Behavioral task
behavioral1
Sample
1036-99-0x0000000000090000-0x000000000009A000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1036-99-0x0000000000090000-0x000000000009A000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
1036-99-0x0000000000090000-0x000000000009A000-memory.dmp
-
Size
40KB
-
MD5
f43a39c78c6f3e4992b86c026bbf7254
-
SHA1
dfe3e622375fecea316983705a567f2b819d305f
-
SHA256
058845d4a442ef5b14a5e810647daef316fccffbc401cc075e4a013c0596988b
-
SHA512
edd2cee49039f8f95975736d36cdb635c7352c62320de1b2b2c65da7e3a9da1b04f88c903c316deb1d30b56f5d58345c4d926375d2ad6af7211e6e7bbb9858a0
-
SSDEEP
192:h+8C+EKS0O9ejYTDG8bcp4Ll9qnieXubWyD9JEBkGxVXOlqoNxRJ:hNVjYTDG8gpwxeXTyD3EnxFoN
Malware Config
Extracted
revengerat
NyanCatRevenge
m7.ddns.com.br:5222
30c2ac3031a0
Signatures
-
Revengerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1036-99-0x0000000000090000-0x000000000009A000-memory.dmp
Files
-
1036-99-0x0000000000090000-0x000000000009A000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ