General
-
Target
Purchase Order No. PO2732559-022.pdf (742 KB).exe
-
Size
808KB
-
Sample
220905-pp2qeabfd2
-
MD5
a2609cffa6b57d22ffbe342013f59847
-
SHA1
9dd92ebe68c7b149cb09edebf7587adf7ee5a4e5
-
SHA256
ea32c3c39c8c3f83e95916262d37b5aa49c920a9356dcebfa639b8391413ae9a
-
SHA512
adb6409708564e0e4070e22c2f0786861f756721f6e2defb15e3e7dc4547336d5d7f70b347a3c0f105acae0ae312b08470154fe0ea09ee5a912cd1d76a4d2b9f
-
SSDEEP
12288:SzE+eQ2iNEF75euLUDYGbOwUjJLN4DXwEBYHofeVs06RBteoqpo1cxWY4/:ZQ16Z5fSYv5vsXwVHofdYoqpo2
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order No. PO2732559-022.pdf (742 KB).exe
Resource
win7-20220812-en
Malware Config
Extracted
netwire
podzeye2.duckdns.org:4433
podzeye2.duckdns.org:4411
podzeye2.duckdns.org:4422
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
lock_executable
false
-
offline_keylogger
false
-
password
Password
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
Purchase Order No. PO2732559-022.pdf (742 KB).exe
-
Size
808KB
-
MD5
a2609cffa6b57d22ffbe342013f59847
-
SHA1
9dd92ebe68c7b149cb09edebf7587adf7ee5a4e5
-
SHA256
ea32c3c39c8c3f83e95916262d37b5aa49c920a9356dcebfa639b8391413ae9a
-
SHA512
adb6409708564e0e4070e22c2f0786861f756721f6e2defb15e3e7dc4547336d5d7f70b347a3c0f105acae0ae312b08470154fe0ea09ee5a912cd1d76a4d2b9f
-
SSDEEP
12288:SzE+eQ2iNEF75euLUDYGbOwUjJLN4DXwEBYHofeVs06RBteoqpo1cxWY4/:ZQ16Z5fSYv5vsXwVHofdYoqpo2
-
NetWire RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-