Overview

overview

10

Static

static

3

JaffaCakes...b0.exe

windows7-x64

8

JaffaCakes...b0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0

  • Size

    99KB

  • Sample

    250102-2x3znaypcw

  • MD5

    68bb2bc04c3e1e1c2d88aa6f73285bb0

  • SHA1

    dc00c4fb8e14e11395935b215c86c88e3e72e0eb

  • SHA256

    46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107

  • SHA512

    f610028ac9d39912d62e8dc8e26f9bbe13f061066561999cb40e0b61362bfc249f35829dacb8d4cb12b1622ed729a4afbc7f73f2595d76da65f4e65807c5a276

  • SSDEEP

    3072:elwT11JOsyobBuL7OdhR5rgGuXMQ8oWfz16xK:EwxdbBuLSdlwWoWh6xK

Score
10/10
netwirebotnetdiscoveryevasionpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

wallou.publicvm.com:3365

mediafire.duckdns.org:3365
Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    MAJ

  • keylogger_dir

    %AppData%\System\

  • lock_executable

    true

  • mutex

    KgpcGWmM

  • offline_keylogger

    true

  • password

    Reborn

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      JaffaCakes118_68bb2bc04c3e1e1c2d88aa6f73285bb0

    • Size

      99KB

    • MD5

      68bb2bc04c3e1e1c2d88aa6f73285bb0

    • SHA1

      dc00c4fb8e14e11395935b215c86c88e3e72e0eb

    • SHA256

      46f5b5e478dfd2fc33d4afd1d0deea9a641a6baf7880bf2fab9a333647b18107

    • SHA512

      f610028ac9d39912d62e8dc8e26f9bbe13f061066561999cb40e0b61362bfc249f35829dacb8d4cb12b1622ed729a4afbc7f73f2595d76da65f4e65807c5a276

    • SSDEEP

      3072:elwT11JOsyobBuL7OdhR5rgGuXMQ8oWfz16xK:EwxdbBuLSdlwWoWh6xK

    Score
    10/10
    discoveryevasionpersistencenetwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Netwire family

      netwire

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks