General

  • Target

    a1d9f729ba0a93ca92686b0db80ceb5a_JaffaCakes118

  • Size

    553KB

  • Sample

    240817-ke2kfawfqa

  • MD5

    a1d9f729ba0a93ca92686b0db80ceb5a

  • SHA1

    6835e4b44a748d067fbb9fcc1d7f4ad7d2cf61d5

  • SHA256

    e866ce1a165219488a44eab3ae217e8f849951f5c8859f0f848768c909609406

  • SHA512

    45c35f44c73ff3cff81b7c31737257b37c809cd063a25c6cdb1986b71a5508e4ecae9a7afa0228514a41f448f975e8aa1a84771b1e3b0ae996637d5ef892480f

  • SSDEEP

    6144:7mCNnDzCA1x4X3PXrPJAVcD8LPhSiWofQr2k5l8Xb4ZFFpt0bowi/EH1:7zBRUfXacD8pellob4zKo//EH1

Malware Config

Extracted

Family

netwire

C2

185.61.138.216:456

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      a1d9f729ba0a93ca92686b0db80ceb5a_JaffaCakes118

    • Size

      553KB

    • MD5

      a1d9f729ba0a93ca92686b0db80ceb5a

    • SHA1

      6835e4b44a748d067fbb9fcc1d7f4ad7d2cf61d5

    • SHA256

      e866ce1a165219488a44eab3ae217e8f849951f5c8859f0f848768c909609406

    • SHA512

      45c35f44c73ff3cff81b7c31737257b37c809cd063a25c6cdb1986b71a5508e4ecae9a7afa0228514a41f448f975e8aa1a84771b1e3b0ae996637d5ef892480f

    • SSDEEP

      6144:7mCNnDzCA1x4X3PXrPJAVcD8LPhSiWofQr2k5l8Xb4ZFFpt0bowi/EH1:7zBRUfXacD8pellob4zKo//EH1

    • NetWire RAT payload

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks