Overview

overview

10

Static

static

10

JaffaCakes...e6.exe

windows7-x64

10

JaffaCakes...e6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_1a3a70e34d3169bbe48da5c865a409e6

  • Size

    127KB

  • MD5

    1a3a70e34d3169bbe48da5c865a409e6

  • SHA1

    2d28d8ba36ab3c5895eb8c2535cdcab2181a9d10

  • SHA256

    e6922b683b88493593b5767f8ec0e9076f3ed3a1e7a156575800817ddb7b9e9f

  • SHA512

    ee1afc8dc98e2a0c9f8309c54fd6a700418113c1ec941fc8ef182bdbcb50480eb63e0530d5ce6eef6bb734405b917ea413057471214d7316b4cdf974e404777f

  • SSDEEP

    3072:yb3RWhfmSbEsz7nD/x0dZTGvd+PACdEDXJS6eb5Viz7wREMV7:OIhfmSosz7nD/qvCdSdEDk6eb5VizsRL

Score
10/10
ratnetwire

Malware Config

Extracted

Family

netwire

C2

127.0.0.1:443

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    TEST

  • keylogger_dir

    %AppData%\wincfg\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    TEST

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 1 IoCs
    rat
  • Netwire family
    netwire
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • JaffaCakes118_1a3a70e34d3169bbe48da5c865a409e6
    .exe windows:4 windows x86 arch:x86

    3552255b0308f758d071474baf31cb31


    Headers

    Imports

    Sections