Overview

overview

10

Static

static

10

Client.exe

windows7-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client.exe

  • Size

    146KB

  • Sample

    230728-maq91sch84

  • MD5

    7c6887a5440dbd2f3e1e63a478e73439

  • SHA1

    187934cc4e55830fecb6a906fa389f6146f8a075

  • SHA256

    8575bbd6c6d677491401cf901173f5518c3169f7481dc426c283fba9d5056509

  • SHA512

    94df707f52c448a59d34943f2eeea35a5c777378b6547fab0b2ce09182615756ad4bc6c12b1ac229073fd2101345c1ed3790d44c8f20a4e009e7448226130ab6

  • SSDEEP

    3072:sr85CwjF9+lcUIMSDD9SYEVBCf3p9ezOV:k9m9+lcTnDR7EVBO3pT

Score
10/10
neshtarevengeratmybotpersistencespywarestealertrojan

Malware Config

Extracted

Family

revengerat

Botnet

MyBot

C2

209.25.141.181:54077

Mutex

RV_MUTEX-NnFwUnoWrUUg

Targets

    • Target

      Client.exe

    • Size

      146KB

    • MD5

      7c6887a5440dbd2f3e1e63a478e73439

    • SHA1

      187934cc4e55830fecb6a906fa389f6146f8a075

    • SHA256

      8575bbd6c6d677491401cf901173f5518c3169f7481dc426c283fba9d5056509

    • SHA512

      94df707f52c448a59d34943f2eeea35a5c777378b6547fab0b2ce09182615756ad4bc6c12b1ac229073fd2101345c1ed3790d44c8f20a4e009e7448226130ab6

    • SSDEEP

      3072:sr85CwjF9+lcUIMSDD9SYEVBCf3p9ezOV:k9m9+lcTnDR7EVBO3pT

    Score
    10/10
    neshtarevengeratmybotpersistencespywarestealertrojan

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • RevengeRat Executable

      stealer

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks