General
-
Target
1f5c1b02db3e7c002e7a706b410e62b6_JaffaCakes118
-
Size
783KB
-
Sample
240507-ef2zpsgh3v
-
MD5
1f5c1b02db3e7c002e7a706b410e62b6
-
SHA1
d09236b586997b3fc4f464cbe622eb57be759949
-
SHA256
489c7b7ee9ae9d46261f547b45d7b1dcce3c06e351217647b024603eee673046
-
SHA512
05ec966bf53e96aa82eea602705216acda51b9f2837ca3fdb883947d8ccf950afe69201026ff988265cbe8ed4730ff88163daa61b807b3ad6c10f464e662553c
-
SSDEEP
12288:hlh4g0ku6gV76xW5TevBIeMBZ9viXPK3EJFa:fBIeMBZ9viXPK3Eu
Static task
static1
Behavioral task
behavioral1
Sample
1f5c1b02db3e7c002e7a706b410e62b6_JaffaCakes118.ps1
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1f5c1b02db3e7c002e7a706b410e62b6_JaffaCakes118.ps1
Resource
win10v2004-20240419-en
Malware Config
Extracted
C:\Users\Admin\BEFC93-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\7-Zip\8AB976-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
1f5c1b02db3e7c002e7a706b410e62b6_JaffaCakes118
-
Size
783KB
-
MD5
1f5c1b02db3e7c002e7a706b410e62b6
-
SHA1
d09236b586997b3fc4f464cbe622eb57be759949
-
SHA256
489c7b7ee9ae9d46261f547b45d7b1dcce3c06e351217647b024603eee673046
-
SHA512
05ec966bf53e96aa82eea602705216acda51b9f2837ca3fdb883947d8ccf950afe69201026ff988265cbe8ed4730ff88163daa61b807b3ad6c10f464e662553c
-
SSDEEP
12288:hlh4g0ku6gV76xW5TevBIeMBZ9viXPK3EJFa:fBIeMBZ9viXPK3Eu
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Renames multiple (7443) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-