netwire | JaffaCakes118_e7974e52efbe751c7ce18af337879a24bccf1b8d78b7d4ddc4d70c69f98961d1

General

Target
JaffaCakes118_e7974e52efbe751c7ce18af337879a24bccf1b8d78b7d4ddc4d70c69f98961d1
Size 204KB
Sample241229-e48gdsspaw
SHA256 e7974e52efbe751c7ce18af337879a24bccf1b8d78b7d4ddc4d70c69f98961d1
MD5 ecb165dd8bc515ee7a9ceea6bfcbe5dd
SHA1 bc3028683d3916b918a27fe721642becbcb2dde4
SHA512 3ab0ac66d21bf6f2b4f450fc00d12334d55e336221fc490ca44ec04d7baf5c5ac34eb6f15d98ced7371c1e12a8b6d249405a2a7c380207aa9a35dfa3a4c1c4f1
SSDEEP 6144:jOTcK+NrRioGHlz8rz0i/U7zQqqDp+Ff:rK+Nr8MrYi/eqFO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat netwire

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
sample	netwire

Netwire family
netwire

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_e7974e52efbe751c7ce18af337879a24bccf1b8d78b7d4ddc4d70c69f98961d1

File Explorer

JaffaCakes118_e7974e52efbe751c7ce18af337879a24bccf1b8d78b7d4ddc4d70c69f98961d1

.exe 204KB

JaffaCakes118_e7974e52efbe751c7ce18af337879a24bccf1b8d78b7d4ddc4d70c69f98961d1

SHA256 e7974e52efbe751c7ce18af337879a24bccf1b8d78b7d4ddc4d70c69f98961d1
MD5 ecb165dd8bc515ee7a9ceea6bfcbe5dd
SHA1 bc3028683d3916b918a27fe721642becbcb2dde4
SHA512 3ab0ac66d21bf6f2b4f450fc00d12334d55e336221fc490ca44ec04d7baf5c5ac34eb6f15d98ced7371c1e12a8b6d249405a2a7c380207aa9a35dfa3a4c1c4f1
SSDEEP 6144:jOTcK+NrRioGHlz8rz0i/U7zQqqDp+Ff:rK+Nr8MrYi/eqFO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NetWire RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9261

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

129KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

49B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_e7974e52efbe751c7ce18af337879a24bccf1b8d78b7d4ddc4d70c69f98961d1

generic