Extracted

Extracted

• • Target

    cf63d0b15d5d11efe96b97b75ec9e767_JaffaCakes118

  • Size

    1KB

  • MD5

    cf63d0b15d5d11efe96b97b75ec9e767

  • SHA1

    7bc07ee8846a857df1212d808c968a357104965c

  • SHA256

    69a7fd5ba6e543deeba3bc302c5cde78e0e089e95b28a86a46783d5db0f8c683

  • SHA512

    0f65c743989ce23c419865aec2bdb5ad23878015b9bca8fd140843bb3a77ea7f04652f7b105e758ee5a0b9f3a20743896af0c4ee3b65656df855056bad9efdc0

  Score

  10^/10

  discoveryexecutionrevengerat442,stealertrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • RevengeRat Executable

    stealer

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2