Overview

overview

10

Static

static

3

jaffacakes...mf.exe

windows10-2004-x64

10

jaffacakes...mf.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_Trojan.Win32.Inject.wnmf.cc7fc72a6567e119f8c49f9667c79edd
  • Size 1.0MB
  • Sample261018-vs5jcssvbw
  • SHA256 04e91cd8746bd9d98500bae1d807c17bfb18d0a1229d6acdf9c20efec3f12efe
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
revengerataqdefense_evasiondiscoverypersistencetrojan

Malware Config

Extracted

Family

  • revengerat

Botnet

  • aq

C2

  • 2.kingx.info:334

  • 2.kingx.info:333

  • 127.0.0.1:334

  • 127.0.0.1:333

  • kingspy.dynu.com:334

  • kingspy.dynu.com:333

Mutex

  • RV_MUTEX-QpnFwUnoWrUUg

Targets

    • Target
      jaffacakes118_Trojan.Win32.Inject.wnmf.cc7fc72a6567e119f8c49f9667c79edd
    • Size 1.0MB
    • SHA256 04e91cd8746bd9d98500bae1d807c17bfb18d0a1229d6acdf9c20efec3f12efe
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    aqdefense_evasiondiscoveryrevengeratpersistencetrojan

    • Family: RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • Executes a file named after a Windows system binary

      The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

      defense_evasion

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks