General
-
Target
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42
-
Size
353KB
-
Sample
220626-2gf5ysdadq
-
MD5
e17086e3005706b0dedd321a40b05dcf
-
SHA1
d4c20146860571653827169e840f81e8a58b462e
-
SHA256
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42
-
SHA512
18038d73b757ded30d73195dcf477fbabf8ea7050cfcea83802d0b9cd8a0a9e1f65cfb6dc1bbde35a326c6e2b82992bc7d81743af748475eb816671440c4d773
Static task
static1
Behavioral task
behavioral1
Sample
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42.exe
Resource
win10v2004-20220414-en
Malware Config
Extracted
netwire
pustios.ug:6971
testingskapss.ru:6971
papapamels.ru:6971
testingskapss.su:6971
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
mutex
JTbRfkgY
-
offline_keylogger
false
-
password
ppF7"oRyqm
-
registry_autorun
false
-
use_mutex
true
Targets
-
-
Target
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42
-
Size
353KB
-
MD5
e17086e3005706b0dedd321a40b05dcf
-
SHA1
d4c20146860571653827169e840f81e8a58b462e
-
SHA256
35f40b70827c3c3159944dc9fe16d128efbbe666fda0493fd7cc380405603a42
-
SHA512
18038d73b757ded30d73195dcf477fbabf8ea7050cfcea83802d0b9cd8a0a9e1f65cfb6dc1bbde35a326c6e2b82992bc7d81743af748475eb816671440c4d773
Score10/10-
NetWire RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-