General
-
Target
58b742a8ed546cf478aa580d3ca5fb4f_JaffaCakes118
-
Size
904KB
-
Sample
240519-fwbm5abh6v
-
MD5
58b742a8ed546cf478aa580d3ca5fb4f
-
SHA1
dfe82e7ebc4193fbe61c041b93d0c6d2df1ecc7c
-
SHA256
c99f0cdc9ce6460f62519b06cbf3ac42deef8e62607b91410cc02edb75ed2fe3
-
SHA512
9fac7484dd996ca12fbbd5a50ee6ec3c7ff164ceddc537590247ed6f0f85c22f209e75eedef7b10f26fbf48dccdde5242a474eac1c2d89a1d985dd6db8dd8500
-
SSDEEP
12288:sOCK75efghgLg/GDL6LOLL7LkXx4OKqWLLLivLYLLL8LxL5R:F
Static task
static1
Behavioral task
behavioral1
Sample
58b742a8ed546cf478aa580d3ca5fb4f_JaffaCakes118.ps1
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
58b742a8ed546cf478aa580d3ca5fb4f_JaffaCakes118.ps1
Resource
win10v2004-20240426-en
Malware Config
Extracted
C:\Program Files (x86)\MSBuild\11F453-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\dotnet\AB763D-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
58b742a8ed546cf478aa580d3ca5fb4f_JaffaCakes118
-
Size
904KB
-
MD5
58b742a8ed546cf478aa580d3ca5fb4f
-
SHA1
dfe82e7ebc4193fbe61c041b93d0c6d2df1ecc7c
-
SHA256
c99f0cdc9ce6460f62519b06cbf3ac42deef8e62607b91410cc02edb75ed2fe3
-
SHA512
9fac7484dd996ca12fbbd5a50ee6ec3c7ff164ceddc537590247ed6f0f85c22f209e75eedef7b10f26fbf48dccdde5242a474eac1c2d89a1d985dd6db8dd8500
-
SSDEEP
12288:sOCK75efghgLg/GDL6LOLL7LkXx4OKqWLLLivLYLLL8LxL5R:F
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Renames multiple (7469) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-