Overview

overview

10

Static

static

1

JaffaCakes...b12.js

windows7-x64

10

JaffaCakes...b12.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_ed35c68140708c925b977f312b250bc247ddabcd52151be10d6d655d1ffe3b12

  • Size

    499KB

  • Sample

    241222-xd1mzawlem

  • MD5

    de8a349133f1e75d532abf15ed1b063a

  • SHA1

    804c7e853d2fa70b6ccb52b3b1866f79f3745988

  • SHA256

    ed35c68140708c925b977f312b250bc247ddabcd52151be10d6d655d1ffe3b12

  • SHA512

    c6eeeeb44eaebd507ffbfd52c3f61036dba218125ac17b83ec47fcd5fe68c276e25be2d38b06293c09077e5bdfbfbc68b72ba6814a27fbbb9082b0622b41274a

  • SSDEEP

    6144:D3F/dnFZnDkmbaw89FIPlplie1u89w7ipeoyPcEURraUrkSk0D1XZaV694uBp5Mz:x/lbDkmbawsF2blBu8eipe1cjPCpzdf

Score
10/10
netwirebotnetdiscoveryexecutionpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

kingshakes1.linkpc.net:8181

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    Kingshakes

  • install_path

    %AppData%\Windows\Update.exe

  • lock_executable

    false

  • mutex

    cTIkpmVV

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      JaffaCakes118_ed35c68140708c925b977f312b250bc247ddabcd52151be10d6d655d1ffe3b12

    • Size

      499KB

    • MD5

      de8a349133f1e75d532abf15ed1b063a

    • SHA1

      804c7e853d2fa70b6ccb52b3b1866f79f3745988

    • SHA256

      ed35c68140708c925b977f312b250bc247ddabcd52151be10d6d655d1ffe3b12

    • SHA512

      c6eeeeb44eaebd507ffbfd52c3f61036dba218125ac17b83ec47fcd5fe68c276e25be2d38b06293c09077e5bdfbfbc68b72ba6814a27fbbb9082b0622b41274a

    • SSDEEP

      6144:D3F/dnFZnDkmbaw89FIPlplie1u89w7ipeoyPcEURraUrkSk0D1XZaV694uBp5Mz:x/lbDkmbawsF2blBu8eipe1cjPCpzdf

    Score
    10/10
    netwirebotnetdiscoveryexecutionpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Netwire family

      netwire

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks