Extracted

• • Target

    97756562952f31b23af0411c0e0b4d1e_JaffaCakes118

  • Size

    511KB

  • MD5

    97756562952f31b23af0411c0e0b4d1e

  • SHA1

    ba15365f2a21419f34961addcad6dad3f7c00e10

  • SHA256

    f63eaf89e94827f4331b6600e6fe09f6c03b8ede2b2862904a3d781678208583

  • SHA512

    d441d0111d70d9140e12e2f3525781a9492d7ddffd59844573100cd8db9efbaaff008a41c674c675ff30fd0e2ccf43d136c48dfda97aed7c0d65f7563a174f90

  • SSDEEP

    12288:QOsJVl3oAad39isf2iyTF2NWBfpC1cipfXWRA:tsl3oAabjuiUFnCyWWRA

  Score

  10^/10

  revengeratdiscoverypersistencespywarestealertrojanupx

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Detected Nirsoft tools

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • RevengeRat Executable

    stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2