Extracted

• • Target

    f9128b44f2f0cdaad14c55483274707b_JaffaCakes118

  • Size

    148KB

  • MD5

    f9128b44f2f0cdaad14c55483274707b

  • SHA1

    a2af6ef62f3fd676be26ce7847f9a7ebedc22912

  • SHA256

    eb368a23aac0fcb965405fd056e125c54af1a779cdd040e71c82614e9ad178e4

  • SHA512

    e3b2e41dfc638f0ca6685e36699c87017ff3cba81fabb586d32216b737d2de90e8fc936464d2c756e05a3014f0934d8592809904defd707d6f176fe2b6fc0ef8

  • SSDEEP

    3072:2XFgYEAsB4+Cb3iiDUCcmE90rvPkGK+drbYMIFfS:2XGYEVat3iiDUCcf+rEG5tzIFf

  Score

  10^/10

  netwirebotnetdiscoveryratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2