Overview

overview

10

Static

static

1

862502255d...3f7.js

windows7-x64

10

862502255d...3f7.js

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    862502255d9fd9eb8f658e23f3833e7cd211514cb9f9a6a2853ae9858d3843f7.js
  • Size 253KB
  • Sample250121-dvanbstndx
  • SHA256 862502255d9fd9eb8f658e23f3833e7cd211514cb9f9a6a2853ae9858d3843f7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
revengeratnyancatrevengeexecutiontrojan

Malware Config

Extracted

Family

  • revengerat

Botnet

  • NyanCatRevenge

C2

  • 13.49.66.229:333

Mutex

  • 8a25aa6e78e44708a

Targets

    • Target
      862502255d9fd9eb8f658e23f3833e7cd211514cb9f9a6a2853ae9858d3843f7.js
    • Size 253KB
    • SHA256 862502255d9fd9eb8f658e23f3833e7cd211514cb9f9a6a2853ae9858d3843f7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    revengeratnyancatrevengeexecutiontrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Revengerat family

      revengerat

    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks