General
-
Target
58c285c3df955356b0de4fd8366aafca_JaffaCakes118
-
Size
903KB
-
Sample
240519-f363lsce33
-
MD5
58c285c3df955356b0de4fd8366aafca
-
SHA1
4573f3abf225c00fddeb3ebdace7bf77bbe04b15
-
SHA256
0b1f6d6c3d5008efd67b9eeebbea8c2e04a2fe3f9ee5db01004384c1419cc170
-
SHA512
c6eb9f8a638f221000783451e4dc3576836a4a34d842c9e8850e2f58e0e5c82b942f31fba8f705532c6cc85057872b2a059e72b40644fdd0c64c3e4a6abb5622
-
SSDEEP
12288:UlKC3i/930kve4tUwcuVJEb1OK4RtGIyc/ZFvRWwajB16I6WY0aMAnbfMeAoJRxI:o
Static task
static1
Behavioral task
behavioral1
Sample
58c285c3df955356b0de4fd8366aafca_JaffaCakes118.ps1
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
58c285c3df955356b0de4fd8366aafca_JaffaCakes118.ps1
Resource
win10v2004-20240426-en
Malware Config
Extracted
C:\Program Files\Microsoft Office\Office14\35A0AF-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Recovery\WindowsRE\5CF39B-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
58c285c3df955356b0de4fd8366aafca_JaffaCakes118
-
Size
903KB
-
MD5
58c285c3df955356b0de4fd8366aafca
-
SHA1
4573f3abf225c00fddeb3ebdace7bf77bbe04b15
-
SHA256
0b1f6d6c3d5008efd67b9eeebbea8c2e04a2fe3f9ee5db01004384c1419cc170
-
SHA512
c6eb9f8a638f221000783451e4dc3576836a4a34d842c9e8850e2f58e0e5c82b942f31fba8f705532c6cc85057872b2a059e72b40644fdd0c64c3e4a6abb5622
-
SSDEEP
12288:UlKC3i/930kve4tUwcuVJEb1OK4RtGIyc/ZFvRWwajB16I6WY0aMAnbfMeAoJRxI:o
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Renames multiple (7416) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-