Extracted

Extracted

Extracted

• • Target

    6122d96e83f0c0dad6d1ed8ab22c60b3_JaffaCakes118

  • Size

    429KB

  • MD5

    6122d96e83f0c0dad6d1ed8ab22c60b3

  • SHA1

    1c9fb09da9a5673b2c821657d1d50440eac79ed6

  • SHA256

    3fcab0addd17f497cf4a7bd90ca5797520a26d98d8fd87b3df5f539cf8cf41bb

  • SHA512

    943086f85de1d466dffb9e9ce1b4ae4ec18139373a4be92fcbc5e91b3e9edb38fbbcc5b3d9c1522af124870f1db9e750f52b2acc9093c4dde518fc9f2de86560

  • SSDEEP

    3072:qxmwANc/nIwANc/nbwANc/nUwANc/nTwANc/nYwANc/ntwANc/n19F:sA29A2cA2ZA20A2NA2+A2nF

  Score

  10^/10

  revengeratvjw0rmkerolyn s2discoveryexecutionstealertrojanworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

    trojanwormvjw0rm

  • RevengeRat Executable

    stealer

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2