General
-
Target
a008c96c6e8790772a2c2f782eef57f7_JaffaCakes118
-
Size
909KB
-
Sample
240612-kdrzlswbqb
-
MD5
a008c96c6e8790772a2c2f782eef57f7
-
SHA1
e0a6fc502a846bf41e945cf97b5645f0b750dc8e
-
SHA256
f01f25a6a6ea86833987ee1a4f6f43c1349258e04e49656765c8830b78720fc4
-
SHA512
639eae5e1ebb44d10dc9b8763cf45b9e5a74ec50ddf972a6dda3cabc532416ec481ea5c3e47eeb6d0d700f9a7dd1ca54d988beb0c9da70039928d2ed3ba375eb
-
SSDEEP
12288:dXcAeyJRoWaf5Fs02EMSPiYUfRLfQkRftpRmPyRf7XcNHiqueRvpkLZJXuGynNe1:Z
Static task
static1
Behavioral task
behavioral1
Sample
a008c96c6e8790772a2c2f782eef57f7_JaffaCakes118.ps1
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a008c96c6e8790772a2c2f782eef57f7_JaffaCakes118.ps1
Resource
win10v2004-20240611-en
Malware Config
Extracted
C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\4868DA-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\7-Zip\B8B3C3-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
a008c96c6e8790772a2c2f782eef57f7_JaffaCakes118
-
Size
909KB
-
MD5
a008c96c6e8790772a2c2f782eef57f7
-
SHA1
e0a6fc502a846bf41e945cf97b5645f0b750dc8e
-
SHA256
f01f25a6a6ea86833987ee1a4f6f43c1349258e04e49656765c8830b78720fc4
-
SHA512
639eae5e1ebb44d10dc9b8763cf45b9e5a74ec50ddf972a6dda3cabc532416ec481ea5c3e47eeb6d0d700f9a7dd1ca54d988beb0c9da70039928d2ed3ba375eb
-
SSDEEP
12288:dXcAeyJRoWaf5Fs02EMSPiYUfRLfQkRftpRmPyRf7XcNHiqueRvpkLZJXuGynNe1:Z
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Renames multiple (7466) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-