Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
fbdca5d8d0459e4f2c0a1a6f9870a000_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fbdca5d8d0459e4f2c0a1a6f9870a000_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fbdca5d8d0459e4f2c0a1a6f9870a000_JaffaCakes118
-
Size
108KB
-
MD5
fbdca5d8d0459e4f2c0a1a6f9870a000
-
SHA1
65ccc01b26739706066f7c5d8b52ef67e4830f89
-
SHA256
02a390aad8d557693715b7d58f42d6685a6f464a7df854b2652993d9e2e53ef0
-
SHA512
0ab28167405d40634a6353f7ade8dc7a3ddf57920ac211568a8b44c75be5be108f4f8e6c15d512367542e3057f6bc690c65c1d67d38a073a46e8941e7c1cdf1d
-
SSDEEP
1536:Wn/RHEQG+JGI0pz0y5W78MmEMmaZiTVRV37jBqaG6D3tSYvGxdHI+:2KV+JGI0pz0yamEMmaZO9j39SYv7+
Malware Config
Extracted
revengerat
Guest
pmoses13-47804.portmap.io:47804
RV_MUTEX
Signatures
-
RevengeRat Executable 1 IoCs
resource yara_rule sample revengerat -
Revengerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fbdca5d8d0459e4f2c0a1a6f9870a000_JaffaCakes118
Files
-
fbdca5d8d0459e4f2c0a1a6f9870a000_JaffaCakes118.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 104KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ