General
-
Target
dea68bfdc6efd19c1dc933d61f115a33_JaffaCakes118
-
Size
904KB
-
Sample
240913-wy4ppasala
-
MD5
dea68bfdc6efd19c1dc933d61f115a33
-
SHA1
18b45cf13c0f34b572dc99c95af2261c5333cbd5
-
SHA256
197390ed197b649aba275ca233a210c21ec03323df2aa5a445db47bee13b619c
-
SHA512
7baf099cc2394499744db0aa9bc18ebb6a77ff5d9784c520a985df074f9ea79527f14ac793d46acb8e091270e342087e2eae25daf700a7e36d86ba7c20344b93
-
SSDEEP
12288:V6AqPKqTq1cMlDjuEyTuCJwhEVg+82QvwyhXf3VZsH8p1dA3OIohPkKwbsWyBYsM:A
Static task
static1
Behavioral task
behavioral1
Sample
dea68bfdc6efd19c1dc933d61f115a33_JaffaCakes118.ps1
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dea68bfdc6efd19c1dc933d61f115a33_JaffaCakes118.ps1
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\Users\Admin\Favorites\Links for United States\11B918-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\7-Zip\719095-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
dea68bfdc6efd19c1dc933d61f115a33_JaffaCakes118
-
Size
904KB
-
MD5
dea68bfdc6efd19c1dc933d61f115a33
-
SHA1
18b45cf13c0f34b572dc99c95af2261c5333cbd5
-
SHA256
197390ed197b649aba275ca233a210c21ec03323df2aa5a445db47bee13b619c
-
SHA512
7baf099cc2394499744db0aa9bc18ebb6a77ff5d9784c520a985df074f9ea79527f14ac793d46acb8e091270e342087e2eae25daf700a7e36d86ba7c20344b93
-
SSDEEP
12288:V6AqPKqTq1cMlDjuEyTuCJwhEVg+82QvwyhXf3VZsH8p1dA3OIohPkKwbsWyBYsM:A
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Renames multiple (7437) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-