General
-
Target
PO-13916.jpeg.exe
-
Size
23KB
-
Sample
210713-ltxq69ql3j
-
MD5
43132b52987daa1e94acd4fba098cc55
-
SHA1
8080d8db03455a2b82fadb74c15d573e7519390a
-
SHA256
289b1b674ae1d8ebd1693294b8f14560195fa8948c61b21478fa75aaa3d76301
-
SHA512
5e544b288d309e98b8e2e3dc8316e0ec0c09f96cfa4ca76a8d163ef3f846dcd6748c6f1f569303a363c715725987dac1b5993f8ba8212d06b2cefd9ad34efcff
Static task
static1
Behavioral task
behavioral1
Sample
PO-13916.jpeg.exe
Resource
win7v20210408
Malware Config
Extracted
netwire
netwire.linkpc.net:6000
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
NETWIRE 2021
- install_path
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
PXVtYqoX
-
offline_keylogger
true
-
password
chizzy25@
-
registry_autorun
false
- startup_name
-
use_mutex
true
Targets
-
-
Target
PO-13916.jpeg.exe
-
Size
23KB
-
MD5
43132b52987daa1e94acd4fba098cc55
-
SHA1
8080d8db03455a2b82fadb74c15d573e7519390a
-
SHA256
289b1b674ae1d8ebd1693294b8f14560195fa8948c61b21478fa75aaa3d76301
-
SHA512
5e544b288d309e98b8e2e3dc8316e0ec0c09f96cfa4ca76a8d163ef3f846dcd6748c6f1f569303a363c715725987dac1b5993f8ba8212d06b2cefd9ad34efcff
-
NetWire RAT payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-