Overview

overview

10

Static

static

10

JaffaCakes...92.exe

windows7-x64

10

JaffaCakes...92.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_8f1e1b819eac04fc624b5ec2395b1664ab50ed641e4b04c15898cadf720c9a92

  • Size

    148KB

  • MD5

    db9234aba32d674eea9759c1d30ec93a

  • SHA1

    d5ac9a2f2c89d49647c8b51e682128c4abe25fbe

  • SHA256

    8f1e1b819eac04fc624b5ec2395b1664ab50ed641e4b04c15898cadf720c9a92

  • SHA512

    906f8551ab4fe10d6d64f2bc8b593e42c8788bd61c6c03a071eb47e7f528a44313b7a9e6049ea0fd1f1d7a938e188fc4f354325c7dbdfc98e9a23e21c995fa93

  • SSDEEP

    3072:2XFgYEAsB4+Cb3iiDUCcmE90rvPkGK+dr3YMIFfS:2XGYEVat3iiDUCcf+rEG5BzIFf

Score
10/10
ratnetwire

Malware Config

Extracted

Family

netwire

C2

127.0.0.1:5002

142.93.223.63:5002
Attributes
  • activex_autorun

    false

  • copy_executable

    true

  • delete_original

    true

  • host_id

    HostId-%Rand%

  • install_path

    %AppData%\Install\images.exe

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    true

  • startup_name

    images.exe

  • use_mutex

    false

Signatures

  • NetWire RAT payload 1 IoCs
    rat
  • Netwire family
    netwire
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_8f1e1b819eac04fc624b5ec2395b1664ab50ed641e4b04c15898cadf720c9a92
    .exe windows:4 windows x86 arch:x86

    4563c74acbd357d386b177e402b96ce4


    Headers

    Imports

    Sections