Overview

overview

10

Static

static

10

60cae37f30...18.exe

windows7-x64

10

60cae37f30...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    60cae37f30f0efa192b10f04e4b899eb_JaffaCakes118

  • Size

    148KB

  • MD5

    60cae37f30f0efa192b10f04e4b899eb

  • SHA1

    a9ad0c977acc4a31aebbf8d3ae12bf3cde29e070

  • SHA256

    60ee16b628a456b8095713496a58240bf6737da861e5dd5c3d124a60bab01b1b

  • SHA512

    cdd8d04eb3d638e6916fa77819f0b0af0369240ed229f19aae3c94b9c331bf9ad4e2e524b8e64ee35595fe9ec20b25c394b962146deee07405803b3fbc600d22

  • SSDEEP

    3072:Q4aT03nsVuaZ1A5m4BlM86fBJLiSeq6755ZM:Q4aw3muaZ1A5m4BOfBpiSeL755ZM

Score
10/10
ratnetwire

Malware Config

Extracted

Family

netwire

C2

timmy77.ddns.net:1083

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    NEW JULY 2019

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    SrwbLOBH

  • offline_keylogger

    true

  • password

    teamoluwa

  • registry_autorun

    false

  • use_mutex

    true

Signatures

  • NetWire RAT payload 1 IoCs
    rat
  • Netwire family
    netwire
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 60cae37f30f0efa192b10f04e4b899eb_JaffaCakes118
    .exe windows:4 windows x86 arch:x86

    78524a324633c13020b2f0da88b89153


    Headers

    Imports

    Sections