General
-
Target
73660e46ac9fff2eaf11cc854b587fbf_JaffaCakes118
-
Size
2.0MB
-
Sample
240525-1zpz5sca9w
-
MD5
73660e46ac9fff2eaf11cc854b587fbf
-
SHA1
b4f77a59b94b2f53795803cb5f43b8c455d9fbfc
-
SHA256
7132baedf3b72b93ae2d9917170fb7ec4d4f0fe6be235149c256b257347f685f
-
SHA512
67715ca727e7e4a165e19890deff5eada442c1fb621bf97fce8175803e00575194cec9df2038eef9510738311ef23d6d2cdd465aa45e4c4b61ef25d86e7ae507
-
SSDEEP
6144:VbeUcV3jSCijLDyDYCCqDYgPjnCUf4oHeljCr63VO6hRcIIKJrlSGAacKEK0usez:j
Static task
static1
Behavioral task
behavioral1
Sample
73660e46ac9fff2eaf11cc854b587fbf_JaffaCakes118.ps1
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
73660e46ac9fff2eaf11cc854b587fbf_JaffaCakes118.ps1
Resource
win10v2004-20240508-en
Malware Config
Extracted
C:\Recovery\77984722-d108-11ee-bdd4-c695cbc44580\F8B00F-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\BC0178-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
73660e46ac9fff2eaf11cc854b587fbf_JaffaCakes118
-
Size
2.0MB
-
MD5
73660e46ac9fff2eaf11cc854b587fbf
-
SHA1
b4f77a59b94b2f53795803cb5f43b8c455d9fbfc
-
SHA256
7132baedf3b72b93ae2d9917170fb7ec4d4f0fe6be235149c256b257347f685f
-
SHA512
67715ca727e7e4a165e19890deff5eada442c1fb621bf97fce8175803e00575194cec9df2038eef9510738311ef23d6d2cdd465aa45e4c4b61ef25d86e7ae507
-
SSDEEP
6144:VbeUcV3jSCijLDyDYCCqDYgPjnCUf4oHeljCr63VO6hRcIIKJrlSGAacKEK0usez:j
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Renames multiple (7496) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-