Extracted

• • Target

    2a02f52b64bb0b2ffce4fb81b4517c7c_JaffaCakes118

  • Size

    216KB

  • MD5

    2a02f52b64bb0b2ffce4fb81b4517c7c

  • SHA1

    b3a46bb392a8b40c12ac046dfdc3572132155aab

  • SHA256

    c5b7e21f19493fed30675f86df39c69fbc3a8a4617d1d85ac3dda90d97d14d6c

  • SHA512

    4814e9064e9ed6c4cdc6e514e7a7e73c227fe598904d654cadb98ef1acee51ba987d937547f80e0aeb1972cda86ae3f22addfaf83490a906ec1927f3980be786

  • SSDEEP

    6144:59nNMa2B9x4UmQrrYfZUgWKZtFivagH8mlE:DNMaA9x4hdWqtAVHv

  Score

  10^/10

  netwirebotnetratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Drops startup file

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2