Extracted

• • Target

    3c550bc74a78425b2f57365650d938cb_JaffaCakes118

  • Size

    179KB

  • MD5

    3c550bc74a78425b2f57365650d938cb

  • SHA1

    349efaa739a9eb5e80c12d3fc269c5ac7642f3ee

  • SHA256

    bd1b202a5eed029524ad2a9947c6bf796352d4da36b43bf738ab833df3ecdaea

  • SHA512

    1ffaa1a27968220cc98778ae2513f51564a35ecd4efebbe78797bde6be4d533a4a4063f6f47104b5761d204e8fffebbb3c934a4efb8f08d964e94699e1ce33f7

  • SSDEEP

    3072:AIZs1DWIIPV0SbLz+Dcjh9SYvioAQWz5GdIQFZ8HRVFqc4vV+:AIqWIIPV0SbP+ojb7qoAfqI3RVFq1E

  Score

  10^/10

  revengeratguestexecutionpersistencestealertrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • RevengeRat Executable

    stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence
  behavioral1behavioral2