Extracted

• • Target

    e612faf3c6e6b0fd54efde7cdd819750_JaffaCakes118

  • Size

    21KB

  • MD5

    e612faf3c6e6b0fd54efde7cdd819750

  • SHA1

    ce59575a14908d3ae8059ea2f116085102d941c5

  • SHA256

    ed1dcba995ed1ca1102131986fa0ad453e2443e1beb614f243c7b420e1a8ab46

  • SHA512

    0aca9d1c79b8387a22fbca20163131e7c4d8624422cf1a9305652a43ab630c7de2810bbd94b77dff86713f7d68c23c9ad91c5ca96d17398cfb11d45e345bf102

  • SSDEEP

    384:px4X0KIjvzobOBCVVuzmVsbYpHsoygDY:D4X2wbICz/3TDY

  Score

  10^/10

  revengeratg1discoverystealertrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • RevengeRat Executable

    stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2