General

  • Target

    f30b759f79a6be1fd1dcb3536d412eb81e187700153522776f70a9c4e8ff3b45.zip

  • Size

    372KB

  • Sample

    240719-xmxbxaverk

  • MD5

    e7aa7d5294d7417865fbbd855973cce1

  • SHA1

    ab0d821c4e0675348ddb0d077718017b08af44fb

  • SHA256

    4feb0d8294232498831f4013c1ed8d495d7b84c4ae38c12900b68fe61e2188b5

  • SHA512

    ec8a620f7ad97c19705740a66bb4fd4e215b1a2a953b12185934bf8fe92d442c4bca84a078df82c632d53a5ab2f9eef110309b7a6dca45cd3ee4b3b4aeb9ecf7

  • SSDEEP

    6144:UF0c3s1ie5nWOw2Ukzdhw/f7Wh4d/UryBiv67h/Xzrd3hYOxjvYCL1:/cc1iexmzf7Y4d/myBiiV3d3+OvBp

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

lua.ddns.com.br:5222

Mutex

101f19215cac

Targets

    • Target

      f30b759f79a6be1fd1dcb3536d412eb81e187700153522776f70a9c4e8ff3b45.ps1

    • Size

      801KB

    • MD5

      f4935e63eaedf1f0392d19e27a9b8d0c

    • SHA1

      8c4c053689ff800fc06225f3958b0cb3aece902a

    • SHA256

      f30b759f79a6be1fd1dcb3536d412eb81e187700153522776f70a9c4e8ff3b45

    • SHA512

      7add6d57d8d70703178892a28d183ff88528d26f17c7438ec9e427cff55ed797a6b2dc909278d5cfea52321d2b9adc2b775b3673e031c2704ff5c3ba41eba0d6

    • SSDEEP

      12288:OZmTk3LmZmTk3Lv2RDsUU1Vq2RDsUU1VV2RDsUU1V2:OZmTAKZmTAr25gq25gV25g2

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks