General
-
Target
41a1e7d5d560fcd83cee7fb1030348ab18cb4f0e37a17e1efc4ad5c21fea978e
-
Size
174KB
-
Sample
220521-xxngracge3
-
MD5
6302183987e1ddeee4c6956ce64accc5
-
SHA1
019e4887b3cbae3a76f427878e4430e28d774a09
-
SHA256
41a1e7d5d560fcd83cee7fb1030348ab18cb4f0e37a17e1efc4ad5c21fea978e
-
SHA512
1f7d919ee5972d13ccacc4c92dceb092d88b3aeb1ae0e41cb392e10e7eafd91593d7501f0da7e6cb26e89bb44085ebfe9b1bdae6e2622b8dbb9c9a642f8b61aa
Static task
static1
Behavioral task
behavioral1
Sample
swift copy .exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
swift copy .exe
Resource
win10v2004-20220414-en
Malware Config
Targets
-
-
Target
swift copy .exe
-
Size
496KB
-
MD5
2e949fbd641fbb0b7a2faa128ddd3540
-
SHA1
eac22a028a62c18391a452850d9c42fbb19b7fb8
-
SHA256
e7cddae953978be6b45011ccbde76cc209eb1bfb3976ba9e214a37df62e3e145
-
SHA512
93d326fc1f0bdace236773275b0969dc191e98979e6f353567bf8ca5479773bf8c811dd9b292136a6a1f2aa0999988c79567ef41f75dde5243ebd628582c1d78
Score10/10-
NetWire RAT payload
-
Modifies Installed Components in the registry
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-