Extracted

• • Target

    9ba6253ad015c09307d24cb2abff6012_JaffaCakes118

  • Size

    549KB

  • MD5

    9ba6253ad015c09307d24cb2abff6012

  • SHA1

    1579300f47c2dd39d11c21ae93c21e4b88688fd0

  • SHA256

    2bd98c799244c446ccba63b66b2734edb73fde31f781dbb585c96eb2289c96da

  • SHA512

    fa9098cc9b16b54c668dcf85e41bceb26cce10f6dfb017b12761eb7939b689bc3cb93ab666bfc5da328e791ee55786e9a57ad69f61d8d6332fe93432ab3b3cd3

  • SSDEEP

    12288:Oa6Jb0lIEuVptZQ1c+NaVdYHC8c769k/:Ov4ItTNKudYHHK6W/

  Score

  10^/10

  netwirebotnetpersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2