General
-
Target
520-69-0x0000000000400000-0x0000000000433000-memory.dmp
-
Size
204KB
-
MD5
e15b93cc8eaaa13412cdc89bed001f3e
-
SHA1
d55756ada72bcdfc005bca383efaf7a9976a5085
-
SHA256
df7ee9579e9bad437d2adff881931b50e145ad10ea30a800e7e05d07f062f779
-
SHA512
667dad5f1b2c3b7d329438737e8d3227be17cc1c661ba7c54c469f2b7149bd4e154d58c19444e0f9e855481fdddc35e9e82806151e1d1db839f2ceca015503b1
-
SSDEEP
6144:S3kUjJY/fRT+iceGUlzFruZdJN9zxqqD:EjJYX1+5OrudJgq
Score
10/10
Malware Config
Extracted
Family
netwire
C2
185.140.53.154:3343
185.140.53.154:3345
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Pass@2022
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 1 IoCs
-
Netwire family
Files
-
520-69-0x0000000000400000-0x0000000000433000-memory.dmp
Headers
Sections