General
-
Target
3816-145-0x0000000000400000-0x0000000000433000-memory.dmp
-
Size
204KB
-
MD5
ee236426d853096eb11efc5336bc573c
-
SHA1
624704ecdce3c4812d5e2a3fc0d02cb3d4088329
-
SHA256
ff717567c5156dec79bbae777eea7420103050b72dd8e39270b4683248528213
-
SHA512
690e3d7bbc8de8675ce4a1cba92ccef447e65417547030951918f5a82050a0c7dfdfc85fd3e675f2b732b08d02d36f6fd120e1d0d65ce6376d2fd63b4fa2662b
-
SSDEEP
3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLvIYMjMqqDvFf:jOTcK+NrRioGHlz8rz0i/IzQqqDvFf
Score
10/10
Malware Config
Extracted
Family
netwire
C2
212.193.30.230:3345
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@9
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 1 IoCs
-
Netwire family
Files
-
3816-145-0x0000000000400000-0x0000000000433000-memory.dmp
Headers
Sections