General
-
Target
ef2a52b9b2457045fefc4d5374b73261_JaffaCakes118
-
Size
904KB
-
Sample
240921-gd2l9sxepn
-
MD5
ef2a52b9b2457045fefc4d5374b73261
-
SHA1
ef3714bf11b603f0f3b8be77d84b98930970b77c
-
SHA256
d0bcef569548210cf0d2f1ade88c6f92d48fb4b1ce7d3bfb21987ca796c6465d
-
SHA512
b9427d73b9edcf5f140816dc615884eff76351c19cb0ffa5860e382599589a7e33a50f22165169790f2621f2e40e4f0d072464e639a1f43503f0d0888ad39b46
-
SSDEEP
12288:sOCK75efghgLg/GDL6LOLL7LkXx4OKqWLLLivLYLLL8LxL5x:l
Static task
static1
Behavioral task
behavioral1
Sample
ef2a52b9b2457045fefc4d5374b73261_JaffaCakes118.ps1
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef2a52b9b2457045fefc4d5374b73261_JaffaCakes118.ps1
Resource
win10v2004-20240802-en
Malware Config
Extracted
C:\Program Files\Java\jdk1.7.0_80\bin\2179CB-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Extracted
C:\Program Files\Microsoft Office\77D69D-Readme.txt
netwalker
http://pb36hu4spl6cyjdfhing7h3pw6dhpk32ifemawkujj4gp33ejzdq3did.onion
http://rnfdsgm6wb6j6su5txkekw4u4y47kp2eatvu7d6xhyn5cs4lt4pdrqqd.onion
Targets
-
-
Target
ef2a52b9b2457045fefc4d5374b73261_JaffaCakes118
-
Size
904KB
-
MD5
ef2a52b9b2457045fefc4d5374b73261
-
SHA1
ef3714bf11b603f0f3b8be77d84b98930970b77c
-
SHA256
d0bcef569548210cf0d2f1ade88c6f92d48fb4b1ce7d3bfb21987ca796c6465d
-
SHA512
b9427d73b9edcf5f140816dc615884eff76351c19cb0ffa5860e382599589a7e33a50f22165169790f2621f2e40e4f0d072464e639a1f43503f0d0888ad39b46
-
SSDEEP
12288:sOCK75efghgLg/GDL6LOLL7LkXx4OKqWLLLivLYLLL8LxL5x:l
Score10/10-
Netwalker Ransomware
Ransomware family with multiple versions. Also known as MailTo.
-
Renames multiple (7383) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-