Overview

overview

10

Static

static

10

1285bd095a...18.exe

windows7-x64

10

1285bd095a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1285bd095abb221e9ce84de643857a54_JaffaCakes118

  • Size

    127KB

  • MD5

    1285bd095abb221e9ce84de643857a54

  • SHA1

    dc920e136edbd8fd5c1ed8b9e8a5c51fcef8b20b

  • SHA256

    2560d1a9dfa7398a9032fad992dc1939a0e014c736cee4b98a8dcc3433751afc

  • SHA512

    726922ea146f6057225cf3dfc6b8d241bbdd120e1ef9043461f958c0ffb53004c825654ff7138670a39d0cd9239ac97f90ea3d80f5f7683da5b379bfe371701f

  • SSDEEP

    3072:Uq3E2BfBSbEsz7nCAFVNNvBGvdO5gPaEjep8Fe7Z1iO7ZbvbLV7:BRBfBSosz7nCA3NHCdXaEj7Fe7Z1iOFR

Score
10/10
ratnetwire

Malware Config

Extracted

Family

netwire

C2

automan.duckdns.org:3382

Attributes
  • activex_autorun

    false

  • copy_executable

    true

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    HDPAYslj

  • offline_keylogger

    true

  • password

    onelove82

  • registry_autorun

    true

  • startup_name

    NetWire

  • use_mutex

    true

Signatures

  • NetWire RAT payload 1 IoCs
    rat
  • Netwire family
    netwire
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 1285bd095abb221e9ce84de643857a54_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    3552255b0308f758d071474baf31cb31


    Headers

    Imports

    Sections