Extracted

• • Target

    JaffaCakes118_f4f5ec10baed6ad8a7f824f2a2506a8338db4b7e71815b2f6bf466645dac7245

  • Size

    77KB

  • MD5

    4e69333b05d347f5383146cb52f2069d

  • SHA1

    b20c2dfec1d341e33caab1826ee49cedb2029db6

  • SHA256

    f4f5ec10baed6ad8a7f824f2a2506a8338db4b7e71815b2f6bf466645dac7245

  • SHA512

    be303a7bcdf7ab9954e025dac326c518c3ac27e5449122fa0e8f729c6c46dc35e993481decbdbc7375f5067dc4ceee4848d576a431fe4056176d7867c9af0a8d

  • SSDEEP

    1536:1Jgz0H2SkJmJere42kaI+NiQtRCDKZX9n3jLNYPu:Hgc7

  Score

  10^/10

  executionrevengeratclientdiscoverytrojan

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat

  • Revengerat family

    revengerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2