General

  • Target

    Quote.js

  • Size

    412KB

  • Sample

    220802-weld1aagdp

  • MD5

    e9f287ce68166c42b0fddaf270e49687

  • SHA1

    b46190560dd95572329e9de12811e67e8d357fa5

  • SHA256

    28f6ad623ccebb96aadb8ecfa53db0af44168d756fd86fb169d0398d260854f0

  • SHA512

    d783d473ea5e12763566f888ff7846abc96d2dee537d149ddfe32e1d85a392d5d0cbfb00288522e4e78107a6a974fd0e0a8e13a1a5786d4dd0cd2253938cb30f

Malware Config

Targets

    • Target

      Quote.js

    • Size

      412KB

    • MD5

      e9f287ce68166c42b0fddaf270e49687

    • SHA1

      b46190560dd95572329e9de12811e67e8d357fa5

    • SHA256

      28f6ad623ccebb96aadb8ecfa53db0af44168d756fd86fb169d0398d260854f0

    • SHA512

      d783d473ea5e12763566f888ff7846abc96d2dee537d149ddfe32e1d85a392d5d0cbfb00288522e4e78107a6a974fd0e0a8e13a1a5786d4dd0cd2253938cb30f

    • NetWire RAT payload

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks