Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
e612faf3c6e6b0fd54efde7cdd819750_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e612faf3c6e6b0fd54efde7cdd819750_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
e612faf3c6e6b0fd54efde7cdd819750_JaffaCakes118
-
Size
21KB
-
MD5
e612faf3c6e6b0fd54efde7cdd819750
-
SHA1
ce59575a14908d3ae8059ea2f116085102d941c5
-
SHA256
ed1dcba995ed1ca1102131986fa0ad453e2443e1beb614f243c7b420e1a8ab46
-
SHA512
0aca9d1c79b8387a22fbca20163131e7c4d8624422cf1a9305652a43ab630c7de2810bbd94b77dff86713f7d68c23c9ad91c5ca96d17398cfb11d45e345bf102
-
SSDEEP
384:px4X0KIjvzobOBCVVuzmVsbYpHsoygDY:D4X2wbICz/3TDY
Malware Config
Extracted
revengerat
G1
185.84.181.90:1175
RV_MUTEX-KawrHJfWfhaRC
Signatures
-
RevengeRat Executable 1 IoCs
resource yara_rule sample revengerat -
Revengerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e612faf3c6e6b0fd54efde7cdd819750_JaffaCakes118
Files
-
e612faf3c6e6b0fd54efde7cdd819750_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ