General

  • Target

    c558f1a93fbb271ba8b0b50b822fe584_JaffaCakes118

  • Size

    601KB

  • Sample

    240827-tqjcnszbla

  • MD5

    c558f1a93fbb271ba8b0b50b822fe584

  • SHA1

    b96b0203cf05d1864fd6013c563935407421e5ec

  • SHA256

    e19811007358c2fea5eba596d6a63a70e11b0accd479ce63afd9be273422a3e6

  • SHA512

    1a6cc8754156a4be60f269d516d32611065ea0e91ed0fa1d528ca2e874af3c73d778ecb5beb0655a630b4e30d528fdbb216c699eb0ce2df1793dcc5055ff1a84

  • SSDEEP

    12288:qQhhmhhzhhZhhFhhihhMhhkhhxhhqhh0hh/hhvhAhhdhh8hhthhUhhRhhXhh1hhF:qQhhmhhzhhZhhFhhihhMhhkhhxhhqhhb

Malware Config

Targets

    • Target

      c558f1a93fbb271ba8b0b50b822fe584_JaffaCakes118

    • Size

      601KB

    • MD5

      c558f1a93fbb271ba8b0b50b822fe584

    • SHA1

      b96b0203cf05d1864fd6013c563935407421e5ec

    • SHA256

      e19811007358c2fea5eba596d6a63a70e11b0accd479ce63afd9be273422a3e6

    • SHA512

      1a6cc8754156a4be60f269d516d32611065ea0e91ed0fa1d528ca2e874af3c73d778ecb5beb0655a630b4e30d528fdbb216c699eb0ce2df1793dcc5055ff1a84

    • SSDEEP

      12288:qQhhmhhzhhZhhFhhihhMhhkhhxhhqhh0hh/hhvhAhhdhh8hhthhUhhRhhXhh1hhF:qQhhmhhzhhZhhFhhihhMhhkhhxhhqhhb

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

    • RevengeRat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Uses the VBS compiler for execution

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks