9dd9dcea8897935e1ad2495d33b9236228dac772ca825cc67c90938bb29aa419
General
Target
Size
Sample
9dd9dcea8897935e1ad2495d33b9236228dac772ca825cc67c90938bb29aa419
868KB
220521-w3ax6sagd9
Score
10 /10
MD5
SHA1
SHA256
SHA512
f047630b6bdd86310d4576a63a94ada6
d721cf61114d0015af33b877fea4b6620075f0a1
9dd9dcea8897935e1ad2495d33b9236228dac772ca825cc67c90938bb29aa419
96e5b54c71c8fa14408616f459b021f8e3309e95800b5ebafa87b7a1fdd1e5baa1961bacbde9f31f4155f146bf739b182b33b72de9c553c904cb2ccccc0a6cf5
Malware Config
Targets
Target
MD5
Filesize
Proof Of Payment.exe
121b665f158aa269dfdd6d701c4af31d
1021KB
Score
10/10
SHA1
SHA256
SHA512
81b94a9e9af1258dd5074adc7077c0fca2de7e79
9e1de81ecb080a9d970953a62de72b6a83cc61776409098f1429c11032cbfa14
af293c732eea9d928e9bcfefc35fbee68ad3af3392503dd3d051ef9dc54df630f6a5a965d364f255c9c25a19465e58ed630edc644eed99c370924aec837b5b68
Tags
Signatures
-
NetWire RAT payload
-
Netwire
Description
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
Tags
-
Executes dropped EXE
-
Checks computer location settings
Description
Looks up country code configured in the registry, likely geofence.
TTPs
-
Loads dropped DLL
-
Adds Run key to start application
Tags
TTPs
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks