General
-
Target
c62af0a3d017f15dba28c763f4a0b646.exe
-
Size
273KB
-
Sample
220719-r5ab7sega6
-
MD5
c62af0a3d017f15dba28c763f4a0b646
-
SHA1
eda4378cbd29ac7e6b919fa545472cfa29af485c
-
SHA256
9754284c45e7c6b119c5d377df3679f88ec3e753390d0f43980b22673302b059
-
SHA512
a0d1842a9eccfed4a6e5a4276f28e7b4ca8a6c974477269a64b17075d68bcaf2c49914492a00476064a0665d46741a6e4f1004ebe85de8553f02351f65b05f3a
Malware Config
Extracted
netwire
robbinson12.publicvm.com:1101
robbinson12.publicvm.com:2009
robbinson12.publicvm.com:7004
robbinson12.publicvm.com:7890
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
c62af0a3d017f15dba28c763f4a0b646.exe
-
Size
273KB
-
MD5
c62af0a3d017f15dba28c763f4a0b646
-
SHA1
eda4378cbd29ac7e6b919fa545472cfa29af485c
-
SHA256
9754284c45e7c6b119c5d377df3679f88ec3e753390d0f43980b22673302b059
-
SHA512
a0d1842a9eccfed4a6e5a4276f28e7b4ca8a6c974477269a64b17075d68bcaf2c49914492a00476064a0665d46741a6e4f1004ebe85de8553f02351f65b05f3a
Score10/10-
NetWire RAT payload
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-