Overview

overview

10

Static

static

1

Boleto2002...r.ppam

windows7-x64

10

Boleto2002...r.ppam

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Boleto2002301988master.ppam

  • Size

    13KB

  • Sample

    230507-g7flwsag4x

  • MD5

    c323058745acd4feab0c15282709a04e

  • SHA1

    8e5a988968000ecfa816352c52bd66490bc2b31a

  • SHA256

    2e07606a2d33855138f2430c5aab7e1894e0e75efd2ab1b39ac76256614ca462

  • SHA512

    fa719dcc24dca693779406ab5eca4f7f4a0bfb736cb91b0868105213c91e0733600a33b49b6fdf4a7bfbaed84ae4407127181b86f6ede9e6f69bcefcd60400c9

  • SSDEEP

    384:dXPzPWrxbb3wiyhJ4eSTbhkIYGgAjLHU+zerK9p:VPObL7yz8hkIp5Vyw

Score
10/10
revengeratnyancatrevengetrojan

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

b2b.ddns.com.br:5222

Mutex

d9261ef3301b4b86a95

Targets

    • Target

      Boleto2002301988master.ppam

    • Size

      13KB

    • MD5

      c323058745acd4feab0c15282709a04e

    • SHA1

      8e5a988968000ecfa816352c52bd66490bc2b31a

    • SHA256

      2e07606a2d33855138f2430c5aab7e1894e0e75efd2ab1b39ac76256614ca462

    • SHA512

      fa719dcc24dca693779406ab5eca4f7f4a0bfb736cb91b0868105213c91e0733600a33b49b6fdf4a7bfbaed84ae4407127181b86f6ede9e6f69bcefcd60400c9

    • SSDEEP

      384:dXPzPWrxbb3wiyhJ4eSTbhkIYGgAjLHU+zerK9p:VPObL7yz8hkIp5Vyw

    Score
    10/10
    revengeratnyancatrevengetrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks