Overview

overview

10

Static

static

8

861375605b...c.docm

windows7-x64

10

861375605b...c.docm

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    861375605b6f4b622556d5b04f6329440a26b38dfa066b114c55d258ac4895bc.doc

  • Size

    109KB

  • Sample

    240802-cg2zzstgmb

  • MD5

    639df28efc7717655b1d8cc618a76b1c

  • SHA1

    9e79c9d82ad07f95b09e73bbba792a889911f51e

  • SHA256

    861375605b6f4b622556d5b04f6329440a26b38dfa066b114c55d258ac4895bc

  • SHA512

    62fdd2c3b2da4481c4cb380e01a37c67f7005e5024cef3b960883b227b659e056680152d2d72002a1496e293e7f97a47d3a67f8ab890b63209a00f19862a3d6c

  • SSDEEP

    1536:vkc1B8Tf5nq7gPgP8MDw/jlQx1JE7vReOr0l77CXXNaHsdUXSIt98iuB/xDC:vV2ClwH9r0l77AnsSmy/B/xDC

Score
10/10
revengeratnyancatrevengedefense_evasiondiscoveryexecutionmacropersistencetrojan

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://drive.google.com/uc?export=download&id=

Extracted

Credentials

  • Protocol:     ftp
  • Host:
    ftp.desckvbrat.com.br
  • Port:
    21
  • Username:
    desckvbrat1
  • Password:
    developerpro21578Jp@@

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

marcelotatuape.ddns.net:333

Mutex

3e042ee793c84

Targets

    • Target

      861375605b6f4b622556d5b04f6329440a26b38dfa066b114c55d258ac4895bc.doc

    • Size

      109KB

    • MD5

      639df28efc7717655b1d8cc618a76b1c

    • SHA1

      9e79c9d82ad07f95b09e73bbba792a889911f51e

    • SHA256

      861375605b6f4b622556d5b04f6329440a26b38dfa066b114c55d258ac4895bc

    • SHA512

      62fdd2c3b2da4481c4cb380e01a37c67f7005e5024cef3b960883b227b659e056680152d2d72002a1496e293e7f97a47d3a67f8ab890b63209a00f19862a3d6c

    • SSDEEP

      1536:vkc1B8Tf5nq7gPgP8MDw/jlQx1JE7vReOr0l77CXXNaHsdUXSIt98iuB/xDC:vV2ClwH9r0l77AnsSmy/B/xDC

    Score
    10/10
    discoveryrevengeratnyancatrevengedefense_evasionexecutionpersistencetrojan

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

JavaScript

1
T1059.007

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Indicator Removal

1
T1070

File Deletion

1
T1070.004

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks