Overview

overview

10

Static

static

3

4a84954ce6...bf.exe

windows7-x64

10

4a84954ce6...bf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a84954ce68f6cd741efd8d08b870dbf

  • Size

    398KB

  • Sample

    231226-b87twaefb2

  • MD5

    4a84954ce68f6cd741efd8d08b870dbf

  • SHA1

    4a09fe016ce1d5a428091eb8ad4a21f44dfccd2b

  • SHA256

    467f273831d5e57240dc252c37f32ecd24111697a885f8245efe29d47266d95c

  • SHA512

    6665eb1794a64b83f01f7d754e19d78fb9f1974709063cee0d967571c312011064deeb97ed0bc7bb785ee40ae5558402e944b589b03633385329d1fbe0b4f77c

  • SSDEEP

    12288:WugETgd/8Gun1uUx0PDBMNWawKBldRQY:KEgdEGKHx+DeNHwKBldRv

Score
10/10
revengeratzgratnyancatrevengepersistencerattrojan

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

dontreachme.duckdns.org:3602

Mutex

774d753e6b8d42

Targets

    • Target

      4a84954ce68f6cd741efd8d08b870dbf

    • Size

      398KB

    • MD5

      4a84954ce68f6cd741efd8d08b870dbf

    • SHA1

      4a09fe016ce1d5a428091eb8ad4a21f44dfccd2b

    • SHA256

      467f273831d5e57240dc252c37f32ecd24111697a885f8245efe29d47266d95c

    • SHA512

      6665eb1794a64b83f01f7d754e19d78fb9f1974709063cee0d967571c312011064deeb97ed0bc7bb785ee40ae5558402e944b589b03633385329d1fbe0b4f77c

    • SSDEEP

      12288:WugETgd/8Gun1uUx0PDBMNWawKBldRQY:KEgdEGKHx+DeNHwKBldRv

    Score
    10/10
    revengeratzgratnyancatrevengepersistencerattrojan

    • Detect ZGRat V1

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks