General
-
Target
182338a8dec61aabd85906ff4ffcac9d.exe
-
Size
627KB
-
Sample
210905-z1k7xachfk
-
MD5
182338a8dec61aabd85906ff4ffcac9d
-
SHA1
898839d66a5c40b4b5236e28bf4a01de91b0f106
-
SHA256
174d091dcf5a5b2c4af35b5df2e4094ddf31bc589208f7b79ff5fc0db2dde514
-
SHA512
334c2d1795f0d8fa64d2f8d828b7583fe5c5e0c10c26cbae0bcf1530c1696759216b408d5629ff6a9e7570195cea22814a7be1de1e46c9b594f004aa5bb36561
Malware Config
Extracted
netwire
185.24.233.3:6130
213.152.162.181:5133
184.75.221.171:5133
199.249.230.27:5133
185.103.96.143:5133
185.104.184.43:5133
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
- install_path
-
keylogger_dir
OSEX\
-
lock_executable
true
-
mutex
lixotYbn
-
offline_keylogger
true
-
password
Password
-
registry_autorun
false
- startup_name
-
use_mutex
true
Targets
-
-
Target
182338a8dec61aabd85906ff4ffcac9d.exe
-
Size
627KB
-
MD5
182338a8dec61aabd85906ff4ffcac9d
-
SHA1
898839d66a5c40b4b5236e28bf4a01de91b0f106
-
SHA256
174d091dcf5a5b2c4af35b5df2e4094ddf31bc589208f7b79ff5fc0db2dde514
-
SHA512
334c2d1795f0d8fa64d2f8d828b7583fe5c5e0c10c26cbae0bcf1530c1696759216b408d5629ff6a9e7570195cea22814a7be1de1e46c9b594f004aa5bb36561
Score10/10-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
NetWire RAT payload
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Adds Run key to start application
-
Drops file in System32 directory
-