General
-
Target
3576-142-0x0000000000400000-0x0000000000433000-memory.dmp
-
Size
204KB
-
MD5
0448a6824a3917e1aaccd2775795f81d
-
SHA1
6d5f11323ac2b31d8752d2fd3f04a803ea36418c
-
SHA256
bbe5abde218aebeeeb1f2d252805da952d40f50bcd6cb178e1711f5b89b5f8fa
-
SHA512
4fdeb1bbb6563500d5bed3785a2273ddebb17ae41d5769699db5005a511a9a6912cf39b7796d13c949039581362a0eef79037cb9360aa7c6d1a11793dd16e771
-
SSDEEP
6144:S3kUjJY/fRT+iceGUlzFruZdJyzxqqD0Ffo:EjJYX1+5OrudJZqEg
Score
10/10
Malware Config
Extracted
Family
netwire
C2
37.0.14.199:3374
37.0.14.199:3377
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
lovemoney12
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 1 IoCs
-
Netwire family
Files
-
3576-142-0x0000000000400000-0x0000000000433000-memory.dmp
Headers
Sections