Overview

overview

10

Static

static

1

00026391087.ppam

windows7-x64

10

00026391087.ppam

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    00026391087.ppam

  • Size

    19KB

  • Sample

    230512-hfrqhsed3s

  • MD5

    f2c6f5b43d73d91bb9eb0de2812ff7cb

  • SHA1

    d4dbf0af4bfbd0f6ce0aadb9dcbbc30cebf36aad

  • SHA256

    2fe97c1cb597d1812cfefe11ce2327da3d18e3cc16bacf38512db1cbd53570d5

  • SHA512

    bd2abddb6f66c5f104925d48d6499ed336e52b43829ee42595f00382c69dccb4398822c8df565c31a44ea9fe12dc4fc31c953652a4698bdf6fbfa96df304a82a

  • SSDEEP

    384:dXPWGaYOMHEG4upmXuB44OPJ8GfkXjedXRMx+CI/tQiZlyszuCqo9NRrccG:VPWGNO7kpme64C21Xjc2xXI/XTys6ARk

Score
10/10
revengeratnyancatrevengetrojan

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

m7.ddns.com.br:5222

Mutex

30c2ac3031a0

Targets

    • Target

      00026391087.ppam

    • Size

      19KB

    • MD5

      f2c6f5b43d73d91bb9eb0de2812ff7cb

    • SHA1

      d4dbf0af4bfbd0f6ce0aadb9dcbbc30cebf36aad

    • SHA256

      2fe97c1cb597d1812cfefe11ce2327da3d18e3cc16bacf38512db1cbd53570d5

    • SHA512

      bd2abddb6f66c5f104925d48d6499ed336e52b43829ee42595f00382c69dccb4398822c8df565c31a44ea9fe12dc4fc31c953652a4698bdf6fbfa96df304a82a

    • SSDEEP

      384:dXPWGaYOMHEG4upmXuB44OPJ8GfkXjedXRMx+CI/tQiZlyszuCqo9NRrccG:VPWGNO7kpme64C21Xjc2xXI/XTys6ARk

    Score
    10/10
    revengeratnyancatrevengetrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks