General
-
Target
0x0008000000014544-58.dat
-
Size
227KB
-
Sample
220905-dsppgacfb3
-
MD5
e8de62af8f6af96ec8048a5698da4876
-
SHA1
36ded00d136509733a1ceceacf823149fb0454b6
-
SHA256
25ab7b7c1c615c6f305835f998698d114e5ddb783248b6af01194dae7a6b5ddf
-
SHA512
ca3f45aaa6e1b77685cee2b4e1b82b3f3e9f8cc9d9e1cdbc2bf5267c850b82cd434574a2b05b43edadb30fa152d7a78e5aa8478657826f929145fcb9c89933d2
-
SSDEEP
6144:mdCAOLZ7r6xhdyJLkEatq0YE2f6rD9Z7vIDECbUn1ItN6pQ/kjMqqDeMln:fAwZixvy9YaY1ItAyGq
Behavioral task
behavioral1
Sample
0x0008000000014544-58.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0x0008000000014544-58.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
0x0008000000014544-58.dat
-
Size
227KB
-
MD5
e8de62af8f6af96ec8048a5698da4876
-
SHA1
36ded00d136509733a1ceceacf823149fb0454b6
-
SHA256
25ab7b7c1c615c6f305835f998698d114e5ddb783248b6af01194dae7a6b5ddf
-
SHA512
ca3f45aaa6e1b77685cee2b4e1b82b3f3e9f8cc9d9e1cdbc2bf5267c850b82cd434574a2b05b43edadb30fa152d7a78e5aa8478657826f929145fcb9c89933d2
-
SSDEEP
6144:mdCAOLZ7r6xhdyJLkEatq0YE2f6rD9Z7vIDECbUn1ItN6pQ/kjMqqDeMln:fAwZixvy9YaY1ItAyGq
Score10/10-
NetWire RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-