Overview

overview

10

Static

static

3

b202ec278b...ca.exe

windows7-x64

10

b202ec278b...ca.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b202ec278be8a5387bac531813f482ca

  • Size

    1.6MB

  • Sample

    240304-nkw4paab52

  • MD5

    b202ec278be8a5387bac531813f482ca

  • SHA1

    772a8ea7f4671d6138701bde80bc50f7f4c3c128

  • SHA256

    8957c7ce7669809a7e22b017f87fefdbfe89caa099b036048019511a5bbc4cb3

  • SHA512

    de51589f8417bc41effccaf4e43f760f898139efbd42eb5aa1c66d3332cedcd664a10df831d09333631dc9682e3bcf850f6978315ba991b5a699c07582b00ace

  • SSDEEP

    24576:tv+4z/kMXYP7I+/qF9fLueyyCgo0N4+47KTQJWs9h4aDiW5FRkTZRM4F:7oP7t/CH7o0N4+ZkJ2aDiIFoZRT

Score
10/10
revengeratzgratnyancatrevengerattrojan

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

dontreachme.duckdns.org:3602

Mutex

774d753e6b8d42

Targets

    • Target

      b202ec278be8a5387bac531813f482ca

    • Size

      1.6MB

    • MD5

      b202ec278be8a5387bac531813f482ca

    • SHA1

      772a8ea7f4671d6138701bde80bc50f7f4c3c128

    • SHA256

      8957c7ce7669809a7e22b017f87fefdbfe89caa099b036048019511a5bbc4cb3

    • SHA512

      de51589f8417bc41effccaf4e43f760f898139efbd42eb5aa1c66d3332cedcd664a10df831d09333631dc9682e3bcf850f6978315ba991b5a699c07582b00ace

    • SSDEEP

      24576:tv+4z/kMXYP7I+/qF9fLueyyCgo0N4+47KTQJWs9h4aDiW5FRkTZRM4F:7oP7t/CH7o0N4+ZkJ2aDiIFoZRT

    Score
    10/10
    zgratratrevengeratnyancatrevengetrojan

    • Detect ZGRat V1

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks