Extracted

• • Target

    2d00003c0d86798183486ea89dbc3c80_JaffaCakes118

  • Size

    518KB

  • MD5

    2d00003c0d86798183486ea89dbc3c80

  • SHA1

    444c4a01af009d7050497da80a5553a1ed55ee52

  • SHA256

    fc3b2a50352fab294532c5b5d47eabad3666ab1f9f1f0b93623ea04aa7900d63

  • SHA512

    9b885f8fe99f1d84ca461d2117e8baefed1d9cc9ea09b8066537b74792b98ffffbfd36fb7e237f823914e92067a8bbc6be1d289345010f3c8153e2ff3e635c9a

  • SSDEEP

    12288:yJpB/QIVLIOZfLvoEdpMmjvevlkrlLBAZbIBHdhzh:yJpB/TLIOlLJpB

  Score

  10^/10

  agilenetexecutionnetwirebotnetratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Suspicious use of SetThreadContext

  behavioral1behavioral2