Overview

overview

10

Static

static

10

6054e7ac17...18.exe

windows7-x64

10

6054e7ac17...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    6054e7ac1718b03bff472dcab4616f8f_JaffaCakes118

  • Size

    1.3MB

  • MD5

    6054e7ac1718b03bff472dcab4616f8f

  • SHA1

    eff7aca24ff0555ae051e07dfa63d677178858e1

  • SHA256

    40b17603ddc60dce8b98e46dc7f49b001cfd697dfe428f3a376be3d28b85137b

  • SHA512

    4c5061978f744a402a131369f2738bf05cfc15279dca48b7f6d614ac5aeb8ec96c8199b6c6920f2de18aa43181f0d4049ecde956ec935a543ea1c26180aea854

  • SSDEEP

    24576:iWmYIGmwJcQtFyYMHW3mT2PKdr5U9hpup2uj2R7SxPe8BEjNlAHgcGSK4+Xsggf:iWmfGmYSBAKdr54h42uj2NSxFKplAZ2t

Score
10/10
ratnetwire

Malware Config

Extracted

Family

netwire

C2

malu1234.duckdns.org:33094

Attributes
  • activex_autorun

    true

  • activex_key

    {QM370X7L-L47Y-C2QN-0HQ0-842M8A5L0144}

  • copy_executable

    true

  • delete_original

    false

  • host_id

    gbam

  • install_path

    %AppData%\Install\Host.exe

  • keylogger_dir

    C:\Users\ptmachine\AppData\Roaming\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    gbam1234

  • registry_autorun

    true

  • startup_name

    NetWire

  • use_mutex

    false

Signatures

  • NetWire RAT payload 1 IoCs
    rat
  • Netwire family
    netwire
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 6054e7ac1718b03bff472dcab4616f8f_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    844b1e992f862088369589b7cf91ba21


    Headers

    Imports

    Sections