Extracted

• • Target

    8a2123d4809ffdc677df37b88d58769c_JaffaCakes118

  • Size

    840KB

  • MD5

    8a2123d4809ffdc677df37b88d58769c

  • SHA1

    4138f2da78ccf7ed3a07d455fddb367f59568d04

  • SHA256

    17453e72156cb5dbd9567d52d6b83436e4f196f6f3c311c4a9b613aaba1a8b80

  • SHA512

    632870596e6f41adefce8a6589ee75b9df1ab483e619d2a2e555f6878a48007c5a38267c576ef3b056559d5348994427e46690034a59388aeee910f4fa93f671

  • SSDEEP

    12288:juCJUOVMQGZGlScgjAFai8/6CAYUNifucTSkPjQMS/kkkkkkk:jNJUOVbocgjA58SCAi2jkPh

  Score

  10^/10

  webmonitorbackdoorinfostealerpersistenceratupx

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    backdoorratinfostealerwebmonitor

  • WebMonitor payload

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Unexpected DNS network traffic destination

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2