netwire | JaffaCakes118_cbd7fac1aa8e0c2fc52d80b39b0eb4741564ad0e18d1c0fc8ea02eac9199285a

General

Target
JaffaCakes118_cbd7fac1aa8e0c2fc52d80b39b0eb4741564ad0e18d1c0fc8ea02eac9199285a
Size 204KB
Sample241221-22d64asrds
SHA256 cbd7fac1aa8e0c2fc52d80b39b0eb4741564ad0e18d1c0fc8ea02eac9199285a
MD5 d7c6fe2ad025f8dead2129ebf7cd71b2
SHA1 bf4a8d49ee345bfc96bd7d38ded3bad4cc984c9f
SHA512 726d8932b64b8f00211001391db683f9e0096d0b156933d7752b4be5450353de428a8952212fdf6b3f4abbeeb52f2da9b64457a12dc3a1ece1b286675d2eba0b
SSDEEP 3072:S3bwUUCZjY/UURTbaiceGUlzFr0qOnZEcsx8VLJiYMSMqqD:S3kUjJY/fRT+iceGUlzFruZdJizxqqD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat netwire

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
sample	netwire

Netwire family
netwire

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_cbd7fac1aa8e0c2fc52d80b39b0eb4741564ad0e18d1c0fc8ea02eac9199285a

File Explorer

JaffaCakes118_cbd7fac1aa8e0c2fc52d80b39b0eb4741564ad0e18d1c0fc8ea02eac9199285a

.exe 204KB

JaffaCakes118_cbd7fac1aa8e0c2fc52d80b39b0eb4741564ad0e18d1c0fc8ea02eac9199285a

SHA256 cbd7fac1aa8e0c2fc52d80b39b0eb4741564ad0e18d1c0fc8ea02eac9199285a
MD5 d7c6fe2ad025f8dead2129ebf7cd71b2
SHA1 bf4a8d49ee345bfc96bd7d38ded3bad4cc984c9f
SHA512 726d8932b64b8f00211001391db683f9e0096d0b156933d7752b4be5450353de428a8952212fdf6b3f4abbeeb52f2da9b64457a12dc3a1ece1b286675d2eba0b
SSDEEP 3072:S3bwUUCZjY/UURTbaiceGUlzFr0qOnZEcsx8VLJiYMSMqqD:S3kUjJY/fRT+iceGUlzFruZdJizxqqD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NetWire RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9261

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

59B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_cbd7fac1aa8e0c2fc52d80b39b0eb4741564ad0e18d1c0fc8ea02eac9199285a

generic