Extracted

• • Target

    cb8f3646b1f9120e39b0df7736813817_JaffaCakes118

  • Size

    334KB

  • MD5

    cb8f3646b1f9120e39b0df7736813817

  • SHA1

    820903daca2aba6c68d188e39036e75188f9aaf6

  • SHA256

    cb278352cefad39d6e0d5ddcbd7b113b1abf6d27fb525d4ab3a79606bef98914

  • SHA512

    868996c0ef7b7fc58cc6502cbf018e6b44f5f2c7d3d2bb8fcbdca21d1cf63b4f58cfc4269c0c6abeec706e6f2e9b4a660c2df63b5f4116dbd639bfe2dc421e50

  • SSDEEP

    6144:KVfPNS/+PNS/fWeymcbBsri3iLNiA1tq4ZKMwuyMS9a:AfPPPWyFgAid1Yowbv

  Score

  10^/10

  netwirebotnetdiscoverypersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2