Extracted

• • Target

    f505850a106a302f7a4ae64686ed7137_JaffaCakes118

  • Size

    177KB

  • MD5

    f505850a106a302f7a4ae64686ed7137

  • SHA1

    6f78c054be779ea4cbcd6100e9f4004dd1d65fed

  • SHA256

    6fa664b3e6255c4f32e6142aa9c23d968e9b1ec58efab5ff1bb30601d08c77cc

  • SHA512

    24c587db202660e8a8d571a3c8cf9667dc9af49046effaedf3318dbfbc91ed9db1d89b47bdd44197a8e4e155e6849b6688cdb89633daeb4d7a7d75bfa5c98bd0

  • SSDEEP

    768:/JUkZ5upgG1i6tTBcdAHZk8ZwLYbDG96e9l:p5SU6vIuk8ZbyFl

  Score

  10^/10

  revengeratdiscoverypersistencestealertrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • RevengeRat Executable

    stealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2