General
-
Target
49b3ed4c73d8d5a6613b725d40172590_JaffaCakes118
-
Size
902KB
-
Sample
240516-gp47jaeh8v
-
MD5
49b3ed4c73d8d5a6613b725d40172590
-
SHA1
07e30496992d7087674cf5542c78856f66ff7737
-
SHA256
1899ff66b76a3f6302fea0afbc26c8452949345d2ea6d987b683c6a0037f22d0
-
SHA512
026c0a58a56747cbb9efab721382924d6da48c65483325ec868c9c894ff601a0461fa3674f4fa01c570635521cc6e7e8c96efe8765fcf68aa7eb713df988e2a3
-
SSDEEP
12288:aeeKC+CqCJCqCwCqC7yH5A7+vEeJaZkeq06aQKLI1XqO/bYyoSWjUUFy55576GYj:J
Static task
static1
Behavioral task
behavioral1
Sample
49b3ed4c73d8d5a6613b725d40172590_JaffaCakes118.ps1
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
49b3ed4c73d8d5a6613b725d40172590_JaffaCakes118.ps1
Resource
win10v2004-20240508-en
Malware Config
Extracted
C:\Program Files\Microsoft Office\Office14\F9D1F3-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Microsoft Office\FAACFA-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
49b3ed4c73d8d5a6613b725d40172590_JaffaCakes118
-
Size
902KB
-
MD5
49b3ed4c73d8d5a6613b725d40172590
-
SHA1
07e30496992d7087674cf5542c78856f66ff7737
-
SHA256
1899ff66b76a3f6302fea0afbc26c8452949345d2ea6d987b683c6a0037f22d0
-
SHA512
026c0a58a56747cbb9efab721382924d6da48c65483325ec868c9c894ff601a0461fa3674f4fa01c570635521cc6e7e8c96efe8765fcf68aa7eb713df988e2a3
-
SSDEEP
12288:aeeKC+CqCJCqCwCqC7yH5A7+vEeJaZkeq06aQKLI1XqO/bYyoSWjUUFy55576GYj:J
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Renames multiple (7461) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-