General
-
Target
TAX_INVO.EXE.exe
-
Size
939KB
-
Sample
220901-k2rnrabcbl
-
MD5
1ae5aa67399707e81cf4fa93f127ebe5
-
SHA1
d3c62b37299568e548dff53b64aaf819d2af0823
-
SHA256
5e6ed3f0eda07ab20f0de1f4c2f9e355a558de4f53b1f81cadae2f3b2d4609a4
-
SHA512
36449ff60fad61af14f084f2a584383bf97a4417f88bdb59881d10e097d4ada81bb802e3b34f536a890bb1bdc76ad21dace065b3837b0e990516496fafbd894e
-
SSDEEP
12288:eF75eqnN7org1+XKeT3unq0jEnrDtyejzJegPwqoXY+mzoRtbvRT7:eZ51ndoNXHynlAnrDYoleXY+mzo3bv
Static task
static1
Behavioral task
behavioral1
Sample
TAX_INVO.EXE.exe
Resource
win7-20220812-en
Malware Config
Extracted
netwire
212.193.30.230:3363
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@2
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
TAX_INVO.EXE.exe
-
Size
939KB
-
MD5
1ae5aa67399707e81cf4fa93f127ebe5
-
SHA1
d3c62b37299568e548dff53b64aaf819d2af0823
-
SHA256
5e6ed3f0eda07ab20f0de1f4c2f9e355a558de4f53b1f81cadae2f3b2d4609a4
-
SHA512
36449ff60fad61af14f084f2a584383bf97a4417f88bdb59881d10e097d4ada81bb802e3b34f536a890bb1bdc76ad21dace065b3837b0e990516496fafbd894e
-
SSDEEP
12288:eF75eqnN7org1+XKeT3unq0jEnrDtyejzJegPwqoXY+mzoRtbvRT7:eZ51ndoNXHynlAnrDYoleXY+mzo3bv
-
NetWire RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-