Overview

overview

10

Static

static

1

2fe97c1cb5...5.ppam

windows7-x64

10

2fe97c1cb5...5.ppam

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2fe97c1cb597d1812cfefe11ce2327da3d18e3cc16bacf38512db1cbd53570d5.zip

  • Size

    17KB

  • Sample

    230516-zhhztsce42

  • MD5

    e8a484eb1befb65a8fb0920037e22ddc

  • SHA1

    73ac946e66b4e6bdad1743de522cc5a26b3e8de8

  • SHA256

    52a898f9c3174c252ef1745e353a49aa898fe99122720bf33126644c319c8df4

  • SHA512

    6a0e28940b8225bf46ed80624dc40241bb9b8d1b71025790bb0ce7207f73e6021773eb40e2b4025d3007ed1ac1f7b104f4b145ed0d5cf2ed09222266be152d94

  • SSDEEP

    384:vL77A60nSvb+7kKgXJsC3f13TZfJte4WPOHbf3Z3G/fOXlmFAuJyvy2:DQ67+DgeC3f1DBG4QOf6faUAuUt

Score
10/10
revengeratnyancatrevengetrojan

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

m7.ddns.com.br:5222

Mutex

30c2ac3031a0

Targets

    • Target

      2fe97c1cb597d1812cfefe11ce2327da3d18e3cc16bacf38512db1cbd53570d5.ppam

    • Size

      19KB

    • MD5

      f2c6f5b43d73d91bb9eb0de2812ff7cb

    • SHA1

      d4dbf0af4bfbd0f6ce0aadb9dcbbc30cebf36aad

    • SHA256

      2fe97c1cb597d1812cfefe11ce2327da3d18e3cc16bacf38512db1cbd53570d5

    • SHA512

      bd2abddb6f66c5f104925d48d6499ed336e52b43829ee42595f00382c69dccb4398822c8df565c31a44ea9fe12dc4fc31c953652a4698bdf6fbfa96df304a82a

    • SSDEEP

      384:dXPWGaYOMHEG4upmXuB44OPJ8GfkXjedXRMx+CI/tQiZlyszuCqo9NRrccG:VPWGNO7kpme64C21Xjc2xXI/XTys6ARk

    Score
    10/10
    revengeratnyancatrevengetrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks