General
-
Target
1728-69-0x0000000000400000-0x0000000000433000-memory.dmp
-
Size
204KB
-
MD5
9f08bc579056ce694985f08e078c234f
-
SHA1
dddb86eb7326276a22bbc9a06799715e8fae1ed6
-
SHA256
0281a61ca8ff509cb26c37cf285d9f80e4001cc9a79c9b85648502ee2eb1ed2e
-
SHA512
ddb7fc33064a80f984db29374f49a047c7fd6a67994c16e5369fcc6dbb1aef4e583403c240f4d8fedc061003aecf94f2a913089198d0dce8676cf2d2e59a4845
-
SSDEEP
6144:S3kUjJY/fRT+iceGUlzFruZdJY8zxqqD:EjJYX1+5OrudJUq
Score
10/10
Malware Config
Extracted
Family
netwire
C2
194.5.98.176:3363
194.5.98.176:3365
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
power2022
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 1 IoCs
-
Netwire family
Files
-
1728-69-0x0000000000400000-0x0000000000433000-memory.dmp
Headers
Sections