Extracted

• • Target

    d8959d67b5ad1af0bd2c8436d8caf1af_JaffaCakes118

  • Size

    367KB

  • MD5

    d8959d67b5ad1af0bd2c8436d8caf1af

  • SHA1

    b5da6b6495219b49f50f0fd68dccf3d0079f206a

  • SHA256

    9f2d5f8c077dbdbc35cb37aabfa9d63c6bce86443cb1a4fc2a820a6ef9568c6d

  • SHA512

    f91c819705846b7b93666376ad485ec97b400acb4aacbf7da83a830e47702184bb3dbdc73e0553e2bd8b99a4b4003512e05864e66e53549ab80bce0410360533

  • SSDEEP

    6144:37YWgp8Jqj3uTE92U1YWgp8Jqj3uTE92UuW6EFvp6/YX5fH1huypYabVY78N7UbE:3UFqY+TEAxFqY+TEAVWJ6QpfPzYab6Qn

  Score

  10^/10

  discoverynetwirebotnetpersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2