Extracted

• • Target

    8674855d9363dedef8bba54a5b5a51d2_JaffaCakes118

  • Size

    1.1MB

  • MD5

    8674855d9363dedef8bba54a5b5a51d2

  • SHA1

    a8401eb792828f10dfdcae790acfe6412b469ca3

  • SHA256

    548439913e50f439d1e39f85392f6521c0e55f3e88045484dc16e2168bcc295b

  • SHA512

    3f6b47bee3e74733771d0e77b0480822913a64046677c1e1814e49654e7446a13c10997f02da83b894dcab182c96c2b680376a63d27609fd05308a18ded6eb79

  • SSDEEP

    24576:f2O/GlkgRCxHTpWbwYVAjEOCLs2lQlZP6944:OsT0/uri9r

  Score

  10^/10

  webmonitorbackdoorinfostealerpersistenceratupx

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    backdoorratinfostealerwebmonitor

  • WebMonitor payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2