General
-
Target
f13ea972b900402696a1f51fb1bf5df7_JaffaCakes118
-
Size
1.3MB
-
Sample
240415-rf4jragc45
-
MD5
f13ea972b900402696a1f51fb1bf5df7
-
SHA1
9c65c21911835ecf925bf63c251fed98bc9b3023
-
SHA256
25cf559d1de914a23563ad710eb291840283e5e9963b3941e51799220cc09ea5
-
SHA512
ee4836d974dd6a09918bf928bc1d2d76dbba203c4ae2d4fedde3f5245108d74be9234d593c5379c3b4bf553cf34f371eaa0c76e3ab4151609b2f61c14ec27fdb
-
SSDEEP
24576:F0NWIrraUcS7foChJIpuSvxGVtWV/Nm/y12NhmbD:FjIfaUrnh6puSvxgryYoD
Static task
static1
Behavioral task
behavioral1
Sample
f13ea972b900402696a1f51fb1bf5df7_JaffaCakes118.exe
Resource
win7-20240319-en
Malware Config
Extracted
netwire
harold.ns01.info:3606
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
prim
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
eApkLVIW
-
offline_keylogger
true
-
password
master12
-
registry_autorun
false
-
use_mutex
true
Targets
-
-
Target
f13ea972b900402696a1f51fb1bf5df7_JaffaCakes118
-
Size
1.3MB
-
MD5
f13ea972b900402696a1f51fb1bf5df7
-
SHA1
9c65c21911835ecf925bf63c251fed98bc9b3023
-
SHA256
25cf559d1de914a23563ad710eb291840283e5e9963b3941e51799220cc09ea5
-
SHA512
ee4836d974dd6a09918bf928bc1d2d76dbba203c4ae2d4fedde3f5245108d74be9234d593c5379c3b4bf553cf34f371eaa0c76e3ab4151609b2f61c14ec27fdb
-
SSDEEP
24576:F0NWIrraUcS7foChJIpuSvxGVtWV/Nm/y12NhmbD:FjIfaUrnh6puSvxgryYoD
-
NetWire RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-