Extracted

• • Target

    4939e21f86162a870d5ea2edfc4e8744_JaffaCakes118

  • Size

    196KB

  • MD5

    4939e21f86162a870d5ea2edfc4e8744

  • SHA1

    263589dc6dad97e8f2f62aa719b2749d5bbb2f19

  • SHA256

    0c1a0c367da54439e8fb305f1065d57cb0a668908c171926e7c15f77cc9f60f1

  • SHA512

    d1a9d5025c4c41ba5f2e94c59873c50e6690528ec891897fab2a0b34b2546c3bd736d14d34a59d67c23cb96aa78b85b34423fc5bf974e388af7f627ea96a754d

  • SSDEEP

    3072:ptIqXZdnssLpsLKRS/uiutwnWjnaEo5w1rPraaG1c0AEWR1rIiV1en8MT/wvF:Myzrey68tiWGSrm+vVPvU8S/wN

  Score

  10^/10

  netwirebotnetratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Drops startup file

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2