netwire | JaffaCakes118_11465eb5bf02ce48c4669be2c0a814ab763ad05db25f18f6e9b7a83e8b717b8a

General

Target
JaffaCakes118_11465eb5bf02ce48c4669be2c0a814ab763ad05db25f18f6e9b7a83e8b717b8a
Size 5.5MB
Sample241230-2c5mravjht
SHA256 11465eb5bf02ce48c4669be2c0a814ab763ad05db25f18f6e9b7a83e8b717b8a
MD5 5e4693e46a8e3afd9e6a8947b537b1ee
SHA1 f5cb284b375f039e73d4800c6b6bd9051e98db55
SHA512 e9889215761cfc9b1ed2a2ee2b5b8ce167df7e66af9589dc4e516299bac13c5f92aefc0b9c22a5d44fb505a60839ef709e28df930166a04ec58b2931e0161ddb
SSDEEP 3072:oOcVBs7SauydcToG4lF4rsx/X7YCd2XL08YM7MqqDvFf:oO2BiSaFyToG4lF4rKXEi8z4qqDvFf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat netwire

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
sample	netwire

Netwire family
netwire

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_11465eb5bf02ce48c4669be2c0a814ab763ad05db25f18f6e9b7a83e8b717b8a

File Explorer

JaffaCakes118_11465eb5bf02ce48c4669be2c0a814ab763ad05db25f18f6e9b7a83e8b717b8a

.exe 5.5MB

JaffaCakes118_11465eb5bf02ce48c4669be2c0a814ab763ad05db25f18f6e9b7a83e8b717b8a

SHA256 11465eb5bf02ce48c4669be2c0a814ab763ad05db25f18f6e9b7a83e8b717b8a
MD5 5e4693e46a8e3afd9e6a8947b537b1ee
SHA1 f5cb284b375f039e73d4800c6b6bd9051e98db55
SHA512 e9889215761cfc9b1ed2a2ee2b5b8ce167df7e66af9589dc4e516299bac13c5f92aefc0b9c22a5d44fb505a60839ef709e28df930166a04ec58b2931e0161ddb
SSDEEP 3072:oOcVBs7SauydcToG4lF4rsx/X7YCd2XL08YM7MqqDvFf:oO2BiSaFyToG4lF4rKXEi8z4qqDvFf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NetWire RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9261

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

129KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

49B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

JaffaCakes118_11465eb5bf02ce48c4669be2c0a814ab763ad05db25f18f6e9b7a83e8b717b8a

generic