Extracted

• • Target

    260b768a03390af34cf4d91ced33fb0e_JaffaCakes118

  • Size

    231KB

  • MD5

    260b768a03390af34cf4d91ced33fb0e

  • SHA1

    19022cee29e978d9e56af5931421c115c522ee31

  • SHA256

    d4103e933d33c9257967b632f9c4cedc5f57e15abd2c0357ce7e9966881cc97d

  • SHA512

    05fd9b1eba3f4217b49b4b7eed58634eb7cf944dfa367a0e868c15862a3399e6e874754ab9ffda785a47a7b850d6e24bc777ba55fe47c1405cd28534869841c3

  • SSDEEP

    3072:2xfqOcLw3jpU6+NAs9ejLSxKy2jSb/DCKvNSs7ZAHS6vYAdz7QgRrYEaFxuAc2:wqOPzpU6+NCLSK8GBcZAHStYXRrYHc2

  Score

  10^/10

  netwirebotnetratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Drops startup file

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2