Extracted

• • Target

    JaffaCakes118_30b3701b19d2406ca13ff9b67cd2a827

  • Size

    172KB

  • MD5

    30b3701b19d2406ca13ff9b67cd2a827

  • SHA1

    8337a06e05a5b4fd50d15e6deda1855d6d8cd3f7

  • SHA256

    8a4b70d8ea1f134a7bfc74fd5d56eb249d7fac934069f218319c53dbe682a21d

  • SHA512

    a26c3a979da54887db9ab9bc3366be7ada712e2dcdf179964ddf7a590a8a23c489e062c0277ac24c7cd2036a4b4944230f861485274124b06e905fd209c8dc61

  • SSDEEP

    3072:I6RrEikYA0QdTh532O8QXJlx3er+jL7ScA96TElZIajM/naFhNlUw4WOXZu:Id0Ih532Kd3zjL7S1kEl7jyaFJm

  Score

  10^/10

  netwirebotnetdiscoveryratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Netwire family

    netwire

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2