Extracted

• • Target

    21c0027924a5a4a70cd1e61220716224_JaffaCakes118

  • Size

    227KB

  • MD5

    21c0027924a5a4a70cd1e61220716224

  • SHA1

    5546ef57a890ca54ee59f52a39d86ea3f24ffe0e

  • SHA256

    cd309ad77ef0180c2c59bab487e90dc967fd0781ec10a4f5196a0fda75cac36d

  • SHA512

    2571b525c8a9ac2abbe09fee720cbc1a4deb9aff288f75f9729475ae3497bcc4853e680015d7ea32d5f09b66425973fa564c0e51b7d10eeff91e369d3ed1ddf0

  • SSDEEP

    6144:JpTfdT/KELr+ILii5Ea8NplE8AOcWRaIF2nYMg:JpTfp/KE3+ILkTplNUWkxYT

  Score

  10^/10

  netwirebotnetratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Drops startup file

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2