General
-
Target
39f51c80d8d21e1ae2a007f80d67e24dbf3742a458dd53c7fc5e0ebf1ae92822
-
Size
604KB
-
Sample
220625-h3pvfadaf8
-
MD5
709f957e6dbe9b0c1457e92aa4cc48d6
-
SHA1
204d345363fd5d0d78d436d3d67cab1c335273ce
-
SHA256
39f51c80d8d21e1ae2a007f80d67e24dbf3742a458dd53c7fc5e0ebf1ae92822
-
SHA512
be56e882e28835c8e6c043d39d59510f3b3a6ce03517095c9d24c8fbca02a6d91c98bf4bd83579b3078fde4147201b010611959d5bb5cc2adfda24a5c2a3ba4f
Static task
static1
Behavioral task
behavioral1
Sample
39f51c80d8d21e1ae2a007f80d67e24dbf3742a458dd53c7fc5e0ebf1ae92822.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
39f51c80d8d21e1ae2a007f80d67e24dbf3742a458dd53c7fc5e0ebf1ae92822.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
netwire
emthai.ddns.net:3365
emthai.ddns.net:1076
-
activex_autorun
false
-
copy_executable
true
-
delete_original
true
-
host_id
HostId-%Emathai%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
mutex
nOQDdboC
-
offline_keylogger
true
-
password
emthai18
-
registry_autorun
true
-
startup_name
Java_Updates
-
use_mutex
true
Targets
-
-
Target
39f51c80d8d21e1ae2a007f80d67e24dbf3742a458dd53c7fc5e0ebf1ae92822
-
Size
604KB
-
MD5
709f957e6dbe9b0c1457e92aa4cc48d6
-
SHA1
204d345363fd5d0d78d436d3d67cab1c335273ce
-
SHA256
39f51c80d8d21e1ae2a007f80d67e24dbf3742a458dd53c7fc5e0ebf1ae92822
-
SHA512
be56e882e28835c8e6c043d39d59510f3b3a6ce03517095c9d24c8fbca02a6d91c98bf4bd83579b3078fde4147201b010611959d5bb5cc2adfda24a5c2a3ba4f
Score10/10-
NetWire RAT payload
-
Executes dropped EXE
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-