revengerat | 29c6eeefb28778392662fb00c32f60b865a96b520f11c82d86b2c97d29b75f1b[.]exe | Triage

Sharing

General

Target

29c6eeefb28778392662fb00c32f60b865a96b520f11c82d86b2c97d29b75f1b.exe
Size

16KB
MD5

f3b5ca2db7b79a0bb68f19b1e2f57890
SHA1

c98a6aad076c016bdcdf312b00fa7407b7eb3643
SHA256

29c6eeefb28778392662fb00c32f60b865a96b520f11c82d86b2c97d29b75f1b
SHA512

f46db5cc9366d913397ce73ecd908840471a6911784070bcb446bfe8d3152e6f21d30fabc96029e8a38533ab97cb378a4ce9ac2dee63e315664cf64c3436446d
SSDEEP

384:deIl8I7mYfcZExHtW3lFDOx3M/IfoNAlp6RpQ:deC8sfEEttWVQxoI1C7Q

Score

10^/10

nyancatrevenge revengerat

Malware Config

Extracted

Family

revengerat

Botnet

NyanCatRevenge

C2

102.165.46.145:333

Mutex

pHXJvbCGPPiC

Signatures

Revengerat family
revengerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
29c6eeefb28778392662fb00c32f60b865a96b520f11c82d86b2c97d29b75f1b.exe

Files

29c6eeefb28778392662fb00c32f60b865a96b520f11c82d86b2c97d29b75f1b.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\pc\Desktop\RevengeRAT C# Stub\Lime\obj\Debug\Lime.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ