General
-
Target
SecuriteInfo.com.Trojan.Olock.1.15033.18325.exe
-
Size
859KB
-
Sample
220906-zpvl7sfdeq
-
MD5
6e79bce3b0d06eea72d5175fbccfa9c3
-
SHA1
862ce39afdd247920ababfd849a4076837d02ffd
-
SHA256
300a0cb2e2f8cd20477c8e0699198f3bca2859e8e6a335c8f4874c83fd627b9f
-
SHA512
4e45c00c1486ef5ca13c164691c80e52ec6379df3fdc2c8582d3b0c83f8cd6e450018f3790544a5982d92eab2741a8d71cbb2444c8b95dc445f25a6d3d35d9ec
-
SSDEEP
12288:tSEBceWB3VDQziVccjA2ZYxVBOQonwGeM5aW+kg9lylSx1:wRBVDmDcjAIEeQAHeY+kgl
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Olock.1.15033.18325.exe
Resource
win7-20220812-en
Malware Config
Extracted
netwire
37.0.14.206:3384
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
offline_keylogger
true
-
password
Password234
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
SecuriteInfo.com.Trojan.Olock.1.15033.18325.exe
-
Size
859KB
-
MD5
6e79bce3b0d06eea72d5175fbccfa9c3
-
SHA1
862ce39afdd247920ababfd849a4076837d02ffd
-
SHA256
300a0cb2e2f8cd20477c8e0699198f3bca2859e8e6a335c8f4874c83fd627b9f
-
SHA512
4e45c00c1486ef5ca13c164691c80e52ec6379df3fdc2c8582d3b0c83f8cd6e450018f3790544a5982d92eab2741a8d71cbb2444c8b95dc445f25a6d3d35d9ec
-
SSDEEP
12288:tSEBceWB3VDQziVccjA2ZYxVBOQonwGeM5aW+kg9lylSx1:wRBVDmDcjAIEeQAHeY+kgl
-
NetWire RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-