General
-
Target
3564b2127c519a9e39b63f0e6994a3d1.exe
-
Size
160KB
-
Sample
220802-wlv7sahfb7
-
MD5
3564b2127c519a9e39b63f0e6994a3d1
-
SHA1
158c22dea6eb92f518af7ea947e08521a904e3ad
-
SHA256
09103f6536c9315c4d1cfa28a4105a2e9bd06f5c432bb62dc5a2b1d0b5902fdd
-
SHA512
37bdd044469917c500a4d4cfc8b8280207198be956bb208efdac7a74dc3a49b97df237885ece8bf8d3e0c9642156c24285e9ed8fa27adad32adbde6613fc5029
Behavioral task
behavioral1
Sample
3564b2127c519a9e39b63f0e6994a3d1.exe
Resource
win7-20220715-en
Malware Config
Extracted
netwire
37.0.14.206:3384
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
offline_keylogger
true
-
password
Password234
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
3564b2127c519a9e39b63f0e6994a3d1.exe
-
Size
160KB
-
MD5
3564b2127c519a9e39b63f0e6994a3d1
-
SHA1
158c22dea6eb92f518af7ea947e08521a904e3ad
-
SHA256
09103f6536c9315c4d1cfa28a4105a2e9bd06f5c432bb62dc5a2b1d0b5902fdd
-
SHA512
37bdd044469917c500a4d4cfc8b8280207198be956bb208efdac7a74dc3a49b97df237885ece8bf8d3e0c9642156c24285e9ed8fa27adad32adbde6613fc5029
-
NetWire RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-