General
-
Target
4a84954ce68f6cd741efd8d08b870dbf
-
Size
398KB
-
Sample
240108-fsqmwacfg9
-
MD5
4a84954ce68f6cd741efd8d08b870dbf
-
SHA1
4a09fe016ce1d5a428091eb8ad4a21f44dfccd2b
-
SHA256
467f273831d5e57240dc252c37f32ecd24111697a885f8245efe29d47266d95c
-
SHA512
6665eb1794a64b83f01f7d754e19d78fb9f1974709063cee0d967571c312011064deeb97ed0bc7bb785ee40ae5558402e944b589b03633385329d1fbe0b4f77c
-
SSDEEP
12288:WugETgd/8Gun1uUx0PDBMNWawKBldRQY:KEgdEGKHx+DeNHwKBldRv
Static task
static1
Behavioral task
behavioral1
Sample
4a84954ce68f6cd741efd8d08b870dbf.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4a84954ce68f6cd741efd8d08b870dbf.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
revengerat
NyanCatRevenge
dontreachme.duckdns.org:3602
774d753e6b8d42
Targets
-
-
Target
4a84954ce68f6cd741efd8d08b870dbf
-
Size
398KB
-
MD5
4a84954ce68f6cd741efd8d08b870dbf
-
SHA1
4a09fe016ce1d5a428091eb8ad4a21f44dfccd2b
-
SHA256
467f273831d5e57240dc252c37f32ecd24111697a885f8245efe29d47266d95c
-
SHA512
6665eb1794a64b83f01f7d754e19d78fb9f1974709063cee0d967571c312011064deeb97ed0bc7bb785ee40ae5558402e944b589b03633385329d1fbe0b4f77c
-
SSDEEP
12288:WugETgd/8Gun1uUx0PDBMNWawKBldRQY:KEgdEGKHx+DeNHwKBldRv
-
Detect ZGRat V1
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-