Extracted

• • Target

    e5868d20318b2068ff916241d36d8f2b_JaffaCakes118

  • Size

    493KB

  • MD5

    e5868d20318b2068ff916241d36d8f2b

  • SHA1

    e5a79616e85351555e13adc3d104844bb0f94106

  • SHA256

    d7d2907883adb90ded1abc61d1e7837fb422b8a1f316e69ab43ae322126898e2

  • SHA512

    4dc61bec51385d539749ec9b3e40751003775cf41a9453dac96702b230de84e245da56bb715401b64ef73da1bd1c02a1ca5249c9f067437444e2e16575efa103

  • SSDEEP

    3072:+PL7/B2pA70HqL9IUoWmdI/vRCnB7T38pCDw7o876fy0s5yth3024xMjgv:+PLYpvg9IN2CB7TMpCDwUOv0s5Ok

  Score

  10^/10

  netwirebotnetdiscoverypersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2