netwire | JaffaCakes118_1d4c98131fb1a7cd2f85a405f1181ad4587b82cc2caff70c26913fb2406b350b

General

Target
JaffaCakes118_1d4c98131fb1a7cd2f85a405f1181ad4587b82cc2caff70c26913fb2406b350b
Size 204KB
Sample241229-rf5f2stjht
SHA256 1d4c98131fb1a7cd2f85a405f1181ad4587b82cc2caff70c26913fb2406b350b
MD5 b3c74bb49514902cd20b41a5d5131d15
SHA1 1f2fccfd1f07cf8f5874bc3fd07a50aa98cb5e66
SHA512 624aec251cf825fa37e04c2e8fb15776179de0abd9825080f43fb828643c54218eb0be8b7cd834057c4bc98c3b6d5da598d484dc8219fb6357b6cd13711c7de0
SSDEEP 3072:S3bwUUCZjY/UURTbaiceGUlzFr0qOnZEcsx8VLJmYMSMqqD:S3kUjJY/fRT+iceGUlzFruZdJmzxqqD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat netwire

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
sample	netwire

Netwire family
netwire

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_1d4c98131fb1a7cd2f85a405f1181ad4587b82cc2caff70c26913fb2406b350b

File Explorer

JaffaCakes118_1d4c98131fb1a7cd2f85a405f1181ad4587b82cc2caff70c26913fb2406b350b

.exe 204KB

JaffaCakes118_1d4c98131fb1a7cd2f85a405f1181ad4587b82cc2caff70c26913fb2406b350b

SHA256 1d4c98131fb1a7cd2f85a405f1181ad4587b82cc2caff70c26913fb2406b350b
MD5 b3c74bb49514902cd20b41a5d5131d15
SHA1 1f2fccfd1f07cf8f5874bc3fd07a50aa98cb5e66
SHA512 624aec251cf825fa37e04c2e8fb15776179de0abd9825080f43fb828643c54218eb0be8b7cd834057c4bc98c3b6d5da598d484dc8219fb6357b6cd13711c7de0
SSDEEP 3072:S3bwUUCZjY/UURTbaiceGUlzFr0qOnZEcsx8VLJmYMSMqqD:S3kUjJY/fRT+iceGUlzFruZdJmzxqqD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NetWire RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9261

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

59B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_1d4c98131fb1a7cd2f85a405f1181ad4587b82cc2caff70c26913fb2406b350b

generic