Extracted

• • Target

    f41c8229b3c54c3ff51191372d9cb790_JaffaCakes118

  • Size

    111KB

  • MD5

    f41c8229b3c54c3ff51191372d9cb790

  • SHA1

    c4d57e6f2b94060a94c4f84863a597c2ef58651d

  • SHA256

    61b69d2a4ca9404f1a5b73fac4790b0a41c7c7f766ba90d5a459612b629bf9b1

  • SHA512

    df6fd5888700d5acc5988821087c7a304e1ceff914320342dd1393f0366c6995828ffd9a82a36b029452215815fdb42e7c7aa9972ef16099fec7d7926a5f6c11

  • SSDEEP

    1536:eR+7RKzXHFJOgDmUiApuj9bcqRaJB2d+JutQNGKZPPXveSxIYjT:eRSKzXlkgC7AKgJSCAY/

  Score

  10^/10

  limeratvjw0rmpersistencerattrojanworm

  • LimeRAT

    Simple yet powerful RAT for Windows machines written in .NET.

    ratlimerat

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2