Extracted

• • Target

    ea952e50775a0c698397e6ec5264efc3_JaffaCakes118

  • Size

    216KB

  • MD5

    ea952e50775a0c698397e6ec5264efc3

  • SHA1

    35573c9f02b72666de5bc3129e98dbe4e67043d1

  • SHA256

    90b71a327684786c22c7a9f4e7b34c893d40ed0c2e14b49205d1d529857a7a06

  • SHA512

    c075d047369269af168ae7888d46d0dfec885cf4cf38e576c6d2603af86132d53c62807ef9c5344e6afdff2f1c2896c96f55992aeee1f6ecd9920795d4e5c316

  • SSDEEP

    6144:7DP0rJQH2vsWppq4llZVyaDtSECbGOW2eQRB4TPIbjy4IwZpow:7DclFpqcl/yaDtSECxJRB4TPGDp

  Score

  10^/10

  netwirebotnetratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2