General
-
Target
5ec42fc9a07d686e27446b78cb39d4828e4f18deb83e24a3ca8eee20cb413697
-
Size
180KB
-
Sample
220731-xz2gdsdhfn
-
MD5
57a2d46109c29a9ce0b3716aee6b3d22
-
SHA1
8d3164d6108ab238f91315c0a48bf8a513b3f7f8
-
SHA256
5ec42fc9a07d686e27446b78cb39d4828e4f18deb83e24a3ca8eee20cb413697
-
SHA512
d2ce5d3470a1bd05e6f4266497437e300d5272d12055270c779b84fbb700179a9c283e1b62edc42a5c27cdc7be7d4389514f3e0a8c6cb2d40324699d7bab5deb
Static task
static1
Behavioral task
behavioral1
Sample
5ec42fc9a07d686e27446b78cb39d4828e4f18deb83e24a3ca8eee20cb413697.exe
Resource
win7-20220718-en
Malware Config
Extracted
netwire
wealthyman.ddns.net:39560
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
sunshineslisa
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
5ec42fc9a07d686e27446b78cb39d4828e4f18deb83e24a3ca8eee20cb413697
-
Size
180KB
-
MD5
57a2d46109c29a9ce0b3716aee6b3d22
-
SHA1
8d3164d6108ab238f91315c0a48bf8a513b3f7f8
-
SHA256
5ec42fc9a07d686e27446b78cb39d4828e4f18deb83e24a3ca8eee20cb413697
-
SHA512
d2ce5d3470a1bd05e6f4266497437e300d5272d12055270c779b84fbb700179a9c283e1b62edc42a5c27cdc7be7d4389514f3e0a8c6cb2d40324699d7bab5deb
-
NetWire RAT payload
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-