General
-
Target
c558f1a93fbb271ba8b0b50b822fe584_JaffaCakes118
-
Size
601KB
-
Sample
240827-tqjcnszbla
-
MD5
c558f1a93fbb271ba8b0b50b822fe584
-
SHA1
b96b0203cf05d1864fd6013c563935407421e5ec
-
SHA256
e19811007358c2fea5eba596d6a63a70e11b0accd479ce63afd9be273422a3e6
-
SHA512
1a6cc8754156a4be60f269d516d32611065ea0e91ed0fa1d528ca2e874af3c73d778ecb5beb0655a630b4e30d528fdbb216c699eb0ce2df1793dcc5055ff1a84
-
SSDEEP
12288:qQhhmhhzhhZhhFhhihhMhhkhhxhhqhh0hh/hhvhAhhdhh8hhthhUhhRhhXhh1hhF:qQhhmhhzhhZhhFhhihhMhhkhhxhhqhhb
Static task
static1
Behavioral task
behavioral1
Sample
c558f1a93fbb271ba8b0b50b822fe584_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c558f1a93fbb271ba8b0b50b822fe584_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Targets
-
-
Target
c558f1a93fbb271ba8b0b50b822fe584_JaffaCakes118
-
Size
601KB
-
MD5
c558f1a93fbb271ba8b0b50b822fe584
-
SHA1
b96b0203cf05d1864fd6013c563935407421e5ec
-
SHA256
e19811007358c2fea5eba596d6a63a70e11b0accd479ce63afd9be273422a3e6
-
SHA512
1a6cc8754156a4be60f269d516d32611065ea0e91ed0fa1d528ca2e874af3c73d778ecb5beb0655a630b4e30d528fdbb216c699eb0ce2df1793dcc5055ff1a84
-
SSDEEP
12288:qQhhmhhzhhZhhFhhihhMhhkhhxhhqhh0hh/hhvhAhhdhh8hhthhUhhRhhXhh1hhF:qQhhmhhzhhZhhFhhihhMhhkhhxhhqhhb
Score10/10-
RevengeRat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Uses the VBS compiler for execution
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-