Extracted

• • Target

    d73e7f87a3a95e0f16337c29a6546efa_JaffaCakes118

  • Size

    204KB

  • MD5

    d73e7f87a3a95e0f16337c29a6546efa

  • SHA1

    753398b57ac5a470d4c2573e1b51cb3ed783e834

  • SHA256

    032f82ee87063844044f26e9c171170ee56b5e480a26402371018512fb92ff6a

  • SHA512

    e966fcfc3fb032e6b602f5bfcbc5842a9c88a8427096f9902e2ec12d08f30c851104c10f10824b084a1e18cf6e9e44114d5f3fd1f688a3d8db6e805976ed4b25

  • SSDEEP

    3072:IxuGg5NaeP3qQKvVpXNdXpstoSjvdQXsAs1XMTsx+7llitfMA6Nbrk42o/O:IsXagIVpXNUtoyHVMlmdt6Nfk42o/O

  Score

  10^/10

  netwirebotnetdiscoverypersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2