General
-
Target
cb6cde58d5a246fcef6a2b1f9ad96dbb_JaffaCakes118
-
Size
908KB
-
Sample
240830-w9ejyazcmn
-
MD5
cb6cde58d5a246fcef6a2b1f9ad96dbb
-
SHA1
1c311562eee808d0af5270beb9cb077893efb066
-
SHA256
b3dcd6e523ce44cf15638ca1f0de17554758f38ed8b7e7965b868fd28cb797dc
-
SHA512
d2cd44fc69252fd3de34497d753ceb5db72e28cff920a2d649456abf98e57d232dedb982e09a5954532389f2cad5a0d986c1f1c0512b0a6f16a470110a5eec59
-
SSDEEP
6144:y/WXp13E8LFVy9KrE0zxiRgvLK9HvsG8todmCn4q/FVv4fTYnGu9TKC8+3KI:y2rbVvdtqzZdKC8+3KI
Static task
static1
Behavioral task
behavioral1
Sample
cb6cde58d5a246fcef6a2b1f9ad96dbb_JaffaCakes118.ps1
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
cb6cde58d5a246fcef6a2b1f9ad96dbb_JaffaCakes118.ps1
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\33BD29-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Users\Admin\Searches\4F7D92-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
cb6cde58d5a246fcef6a2b1f9ad96dbb_JaffaCakes118
-
Size
908KB
-
MD5
cb6cde58d5a246fcef6a2b1f9ad96dbb
-
SHA1
1c311562eee808d0af5270beb9cb077893efb066
-
SHA256
b3dcd6e523ce44cf15638ca1f0de17554758f38ed8b7e7965b868fd28cb797dc
-
SHA512
d2cd44fc69252fd3de34497d753ceb5db72e28cff920a2d649456abf98e57d232dedb982e09a5954532389f2cad5a0d986c1f1c0512b0a6f16a470110a5eec59
-
SSDEEP
6144:y/WXp13E8LFVy9KrE0zxiRgvLK9HvsG8todmCn4q/FVv4fTYnGu9TKC8+3KI:y2rbVvdtqzZdKC8+3KI
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Renames multiple (7466) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-