Overview

overview

10

Static

static

3

c994b9d016...a5.exe

windows7-x64

10

c994b9d016...a5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe

  • Size

    397KB

  • Sample

    240419-cczn3aef4z

  • MD5

    17d0b9ac75dfd038ac11c64940a5a6cb

  • SHA1

    fdf4a6d488ba2220c808a8e233ea0e219273c3b2

  • SHA256

    c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5

  • SHA512

    0ffb63b421da1daa0ca2098ea35b6e5be5b8613b9b4855b723b2c6032bcf644f7d00ddb35ab1af443c5f765fa10c61cb5c28fe81734ea4e582b51ed56c1afecd

  • SSDEEP

    6144:/IWyveo8OzcrumMozCE6+bIPEMMjAtUO3nDv4abP212gG7EXoiToLa:/IpvZDoruYeE6+EsPjA4a7mJWEZga

Score
10/10
revengeratnyancatrevengepersistencetrojan

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

alice2019.myftp.biz:7777

Mutex

a915f6c5466a49

Targets

    • Target

      c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5.exe

    • Size

      397KB

    • MD5

      17d0b9ac75dfd038ac11c64940a5a6cb

    • SHA1

      fdf4a6d488ba2220c808a8e233ea0e219273c3b2

    • SHA256

      c994b9d016129f8a1e36b1e1f3288ef1385c6453497fc50cf129195e9769b8a5

    • SHA512

      0ffb63b421da1daa0ca2098ea35b6e5be5b8613b9b4855b723b2c6032bcf644f7d00ddb35ab1af443c5f765fa10c61cb5c28fe81734ea4e582b51ed56c1afecd

    • SSDEEP

      6144:/IWyveo8OzcrumMozCE6+bIPEMMjAtUO3nDv4abP212gG7EXoiToLa:/IpvZDoruYeE6+EsPjA4a7mJWEZga

    Score
    10/10
    revengeratnyancatrevengepersistencetrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Detects executables packed with or use KoiVM

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks