Extracted

• • Target

    d02593c2d119e8b68052587cb446943a_JaffaCakes118

  • Size

    834KB

  • MD5

    d02593c2d119e8b68052587cb446943a

  • SHA1

    dcf444435c05a2b324c418dbc8550c901ac1643c

  • SHA256

    0400cef226621ad00d51b8880025664e3a916c0c3c3207f3525b8423af52a5f6

  • SHA512

    e0c63ee38271acdbbd8eb42ec7d5e7bd460dfdd22a2865f4e31eee4b5dda65f68c915ebb8527c600f51e4838877b5a3c977a4c5c165e4ea092ed0a8e4d2f53cd

  • SSDEEP

    24576:nN+R2WtRz9mp8Kzx9SLhmf2zHQvPTQtP/:NKhrKzx0Lk0wXTAP/

  Score

  10^/10

  netwirebotnetdiscoveryexecutionpersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2