Overview

overview

10

Static

static

10

JaffaCakes...50.exe

windows7-x64

10

JaffaCakes...50.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_f41dd24943f187032c28c2065c2e1150

  • Size

    56KB

  • Sample

    250111-ch1hjsykev

  • MD5

    f41dd24943f187032c28c2065c2e1150

  • SHA1

    a6b0d8ba4e0f78fb5ed746b3046fad5a41caa01b

  • SHA256

    877c20737b066f465e7fc9bdfebf63fe7290569cb8bc6487fbc7309cde2a71eb

  • SHA512

    a366418c29077612f7b06bea12c9fee5f9a65570caa40a522720c69285e47c0ea69d755a519702d5a00d4fe88a1dacb3f5247f1d12a2430469d411be008e305a

  • SSDEEP

    768:wOs84zLDN05Wx4Wa4F3Gxo/ppQMlzEjKK19dGA2To:D4PRlCWz3CoRpQMlqb1+M

Score
10/10
revengeratdiscoverypersistencestealertrojan

Malware Config

Targets

    • Target

      JaffaCakes118_f41dd24943f187032c28c2065c2e1150

    • Size

      56KB

    • MD5

      f41dd24943f187032c28c2065c2e1150

    • SHA1

      a6b0d8ba4e0f78fb5ed746b3046fad5a41caa01b

    • SHA256

      877c20737b066f465e7fc9bdfebf63fe7290569cb8bc6487fbc7309cde2a71eb

    • SHA512

      a366418c29077612f7b06bea12c9fee5f9a65570caa40a522720c69285e47c0ea69d755a519702d5a00d4fe88a1dacb3f5247f1d12a2430469d411be008e305a

    • SSDEEP

      768:wOs84zLDN05Wx4Wa4F3Gxo/ppQMlzEjKK19dGA2To:D4PRlCWz3CoRpQMlqb1+M

    Score
    10/10
    revengeratdiscoverypersistencestealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Revengerat family

      revengerat

    • RevengeRat Executable

      stealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks