Extracted

• • Target

    93f61ea9b665afc793fa204699cb4125_JaffaCakes118

  • Size

    1.6MB

  • MD5

    93f61ea9b665afc793fa204699cb4125

  • SHA1

    75d62f1bbdafbebc3fe79a4f404a50444170cef2

  • SHA256

    e25b99b58c4f58caa57d6cc934f9efb97489aec576e4ab170eb6feb7793f2eed

  • SHA512

    78e94aff1cd0f6dc032c8c3a716489bb3cd1eeaa293e24ec9e28eb1167ffac88d4f9a9ed57d83aeab31f033c7332ab359f8f2efc372abb7cdbadb1dad2be511f

  • SSDEEP

    24576:Ru6Jx3O0c+JY5UZ+XC0kGso/Wa0Ktp/RutocwUXRitJcXDjhAWY:DI0c++OCvkGsUWaOY

  Score

  10^/10

  webmonitorbackdoorinfostealerratupx

  • RevcodeRat, WebMonitorRat

    WebMonitor is a remote access tool that you can use from any browser access to control, and monitor your phones, or PCs.

    backdoorratinfostealerwebmonitor

  • WebMonitor payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2