General
-
Target
64248d0299618de7464d665ecec906c2_JaffaCakes118
-
Size
908KB
-
Sample
240521-v2bmmsda5s
-
MD5
64248d0299618de7464d665ecec906c2
-
SHA1
163e2607670ee5008ba4d371f0832cbda0743943
-
SHA256
991a843a7f99ffd47fbdd9aa486abcfe8c97540248542b8f1fa878760f70a000
-
SHA512
d2eaf1e04177471ce363a5871dd7586f5da6378a1b99d59fa746b9df618813e726e2f5c7c88d1c6abe219070b2bdcba5ffb78065b8fd381af60eb93ffc15c59a
-
SSDEEP
6144:y/WXp13E8LFVy9KrE0zxiRgvLK9HvsG8todmCn4q/FVv4fTYnGu9TKC8+3Kk:y2rbVvdtqzZdKC8+3Kk
Static task
static1
Behavioral task
behavioral1
Sample
64248d0299618de7464d665ecec906c2_JaffaCakes118.ps1
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
64248d0299618de7464d665ecec906c2_JaffaCakes118.ps1
Resource
win10v2004-20240226-en
Malware Config
Extracted
C:\Program Files (x86)\MSBuild\B1C597-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\605EAE-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
64248d0299618de7464d665ecec906c2_JaffaCakes118
-
Size
908KB
-
MD5
64248d0299618de7464d665ecec906c2
-
SHA1
163e2607670ee5008ba4d371f0832cbda0743943
-
SHA256
991a843a7f99ffd47fbdd9aa486abcfe8c97540248542b8f1fa878760f70a000
-
SHA512
d2eaf1e04177471ce363a5871dd7586f5da6378a1b99d59fa746b9df618813e726e2f5c7c88d1c6abe219070b2bdcba5ffb78065b8fd381af60eb93ffc15c59a
-
SSDEEP
6144:y/WXp13E8LFVy9KrE0zxiRgvLK9HvsG8todmCn4q/FVv4fTYnGu9TKC8+3Kk:y2rbVvdtqzZdKC8+3Kk
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Renames multiple (7440) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-