General
-
Target
1880-124-0x0000000000400000-0x0000000000433000-memory.dmp
-
Size
204KB
-
MD5
419efccffc4a20d3aaf874511fd2ac50
-
SHA1
3436b0ae601cb70919eb3782882697f0a06fb6cf
-
SHA256
2d698b0e16856a7a358f947beb20fca79b3131166cb1671a2e6c43816829248d
-
SHA512
1632dc3a67e33108937b65f55244323b1adb8bdb6728a9a2590a7252e416c192d71495de9cc174201f526713df838a60546f77e95370c7ffd906f9941c07e485
-
SSDEEP
3072:S3bwUUCZjY/UURTbaiceGUlzFr0qOnZEcsx8VLJ9YMSMqqD:S3kUjJY/fRT+iceGUlzFruZdJ9zxqqD
Score
10/10
Malware Config
Extracted
Family
netwire
C2
194.5.98.188:3364
194.5.98.188:3366
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
j5m52xuc
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 1 IoCs
-
Netwire family
Files
-
1880-124-0x0000000000400000-0x0000000000433000-memory.dmp
Headers
Sections