Extracted

• • Target

    0914657239a3497433c1777e60d761e1_JaffaCakes118

  • Size

    390KB

  • MD5

    0914657239a3497433c1777e60d761e1

  • SHA1

    c7d6bca47753362f40e18d44935c75ecd990df2a

  • SHA256

    3b1ae6021b84138920670f125a1f76cf2625fc1ea104e7228a59cce91d899b83

  • SHA512

    e4bf46e5939f399143b41aa4d880bcddb5f0559703691ba968a87d4893d450b689dc8ba002279d238dfbbccbb6844cb982aa21ac60e37e454c0eb48740334efd

  • SSDEEP

    12288:cdq4BnAn7gOsqs3sVYXjRpv2ZPbNpINABZ9JKrT0NJmB:q6vszcKFoVD0ezJQ

  Score

  10^/10

  netwirebotnetpersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2