Extracted

• • Target

    0b18382d5ac0f30d8773acb6d5671a74_JaffaCakes118

  • Size

    728KB

  • MD5

    0b18382d5ac0f30d8773acb6d5671a74

  • SHA1

    f4ccfc6cc940aeb2a30489458f781a6c5d78fdd8

  • SHA256

    af813a303e700b27c7ba44acc90ec98b650c9a0bc0d471fd337f5271c81a7458

  • SHA512

    e089a7b956b692f02dbebfde28a90e2cc8ca6d6743d7587d3b21a556dfc816bd0e40215e180a026dd02ec76a7945b1f70cc4d6f6743f66bf247a52207dea73fd

  • SSDEEP

    12288:8lGRF0NXm4Vtjfx8G8PpJLj8KbqOQjg3uxf9LbNgoGwWbvh8ByS9NULj7OT6G:8oRF0c43r78PbLYKKg3uxfZNgjvVWmL4

  Score

  10^/10

  revengeratdiscoverypersistencespywarestealertrojanupx

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • RevengeRat Executable

    stealer

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2