General
-
Target
eaef25ab1f59492ffc735a386294b69f_JaffaCakes118
-
Size
65KB
-
Sample
240919-j9p98azbnq
-
MD5
eaef25ab1f59492ffc735a386294b69f
-
SHA1
76cc795c39cc19465c24825dc5ebafd7f944ea7e
-
SHA256
4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60
-
SHA512
a812186ff05baa0c194abc2b4becc145f312b885068773f994658ecac2bfd8e1c85acdfe3774728541ed966f46a872d19fee17a53cc07f3f8e2e94be0cdef1c4
-
SSDEEP
1536:kxZab6DtoaWM7pgUJJooLrIZadXRM0CFU6InWU1dil:3GDtDD7prbooLrWaPM0hWai
Static task
static1
Behavioral task
behavioral1
Sample
eaef25ab1f59492ffc735a386294b69f_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eaef25ab1f59492ffc735a386294b69f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\Program Files (x86)\Common Files\Adobe\Updater6\EB5DDA-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\ProgramData\Microsoft\User Account Pictures\1B9799-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
eaef25ab1f59492ffc735a386294b69f_JaffaCakes118
-
Size
65KB
-
MD5
eaef25ab1f59492ffc735a386294b69f
-
SHA1
76cc795c39cc19465c24825dc5ebafd7f944ea7e
-
SHA256
4f7bdda79e389d6660fca8e2a90a175307a7f615fa7673b10ee820d9300b5c60
-
SHA512
a812186ff05baa0c194abc2b4becc145f312b885068773f994658ecac2bfd8e1c85acdfe3774728541ed966f46a872d19fee17a53cc07f3f8e2e94be0cdef1c4
-
SSDEEP
1536:kxZab6DtoaWM7pgUJJooLrIZadXRM0CFU6InWU1dil:3GDtDD7prbooLrWaPM0hWai
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Renames multiple (7408) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Deletes itself
-