revengerat | JaffaCakes118_96f2ead05c2101f4102681b8a862579f | Triage

Sharing

General

Target

JaffaCakes118_96f2ead05c2101f4102681b8a862579f
Size

248KB
MD5

96f2ead05c2101f4102681b8a862579f
SHA1

2222e996c4a5c4d45a08a8a94ed3ba2a43b8f4e4
SHA256

726557246d1615103b842067b98583e645ee517feb2a072bbd2512866ace1ced
SHA512

de97ab5ea9ae9d49fb75a41ae5f752bb962e16bae142ac19f85d4028c271edd650e97e4ca19d7b40c9f6a0ce2b94d6ba1e4709069dc7613b63b3c950546bef1c
SSDEEP

3072:YGKROS5fkMLalsplF9YxKROS5fkMT9S+tERxm0D9:lKRlfdLQsZ8KRlfdDeD9

Score

10^/10

stealer revengerat

Malware Config

Signatures

RevengeRat Executable 1 IoCs

resource	yara_rule
sample	revengerat

Revengerat family
revengerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_96f2ead05c2101f4102681b8a862579f

Files

JaffaCakes118_96f2ead05c2101f4102681b8a862579f
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\FEDERIKO\Documents\Visual Studio 2008\Projects - 2\Server Undetecter\Server Undetecter\obj\Release\Server Undetecter.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 182B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ