Overview

overview

10

Static

static

5

3e9467442e...18.exe

windows7-x64

10

3e9467442e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e9467442e5d328b1e6e4f23672e5f5b_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240513-keqsyaed5s

  • MD5

    3e9467442e5d328b1e6e4f23672e5f5b

  • SHA1

    c38c50d58063658b3d428e9e8dd9c501416d98cf

  • SHA256

    918e7e4a7aa12b74a559bff1813122430a87e3d132ae8c394bf919928d529c2c

  • SHA512

    29d27bff96569b42a8cbfb2bf9e50ed14fc0983bc58c684e0922e81fd940e2e0cfeabdaaa4fa14ac7abdb1241047c6afda0da8e4b688b2e56ddf2f3d1efa7d97

  • SSDEEP

    24576:hu6J33O0c+JY5UZ+XC0kGso6FaQTwzhnpAWY:zu0c++OCvkGs9FahPY

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

77.48.28.195:1969

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    n2

  • lock_executable

    false

  • mutex

    JquNADho

  • offline_keylogger

    false

  • password

    Kimbolsapoq!P13

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      3e9467442e5d328b1e6e4f23672e5f5b_JaffaCakes118

    • Size

      1.1MB

    • MD5

      3e9467442e5d328b1e6e4f23672e5f5b

    • SHA1

      c38c50d58063658b3d428e9e8dd9c501416d98cf

    • SHA256

      918e7e4a7aa12b74a559bff1813122430a87e3d132ae8c394bf919928d529c2c

    • SHA512

      29d27bff96569b42a8cbfb2bf9e50ed14fc0983bc58c684e0922e81fd940e2e0cfeabdaaa4fa14ac7abdb1241047c6afda0da8e4b688b2e56ddf2f3d1efa7d97

    • SSDEEP

      24576:hu6J33O0c+JY5UZ+XC0kGso6FaQTwzhnpAWY:zu0c++OCvkGs9FahPY

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks