General
-
Target
SecuriteInfo.com.Trojan.Siggen9.48175.17546.28131.exe
-
Size
1.0MB
-
Sample
220908-m3d56abegq
-
MD5
e48d3684ab9ae8701aa591397b5d333c
-
SHA1
9137bd3415377d3e77b0dc8d4e69b22ea4b473a1
-
SHA256
9fe290fed627fb78a5f4f92a4e479c63a6b8a2d614fa173bb37d474300c102e6
-
SHA512
d33641ad902718b686a2d334889d00f516363dae766824edacd6412c0f08c4db63a555ad464cb68ff855d33ef27d0fbdfcb2867fab1e4b2e00c23afbbc10328f
-
SSDEEP
12288:TkNjmlx1fDFztKfCWxWrFoT5VPBDwvTgnRcPLHWO4Tyw4N9ER5pzh9K/BUW:TkxmlXDFgsOlDa0R6HWOscSR3P8UW
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen9.48175.17546.28131.exe
Resource
win7-20220812-en
Malware Config
Targets
-
-
Target
SecuriteInfo.com.Trojan.Siggen9.48175.17546.28131.exe
-
Size
1.0MB
-
MD5
e48d3684ab9ae8701aa591397b5d333c
-
SHA1
9137bd3415377d3e77b0dc8d4e69b22ea4b473a1
-
SHA256
9fe290fed627fb78a5f4f92a4e479c63a6b8a2d614fa173bb37d474300c102e6
-
SHA512
d33641ad902718b686a2d334889d00f516363dae766824edacd6412c0f08c4db63a555ad464cb68ff855d33ef27d0fbdfcb2867fab1e4b2e00c23afbbc10328f
-
SSDEEP
12288:TkNjmlx1fDFztKfCWxWrFoT5VPBDwvTgnRcPLHWO4Tyw4N9ER5pzh9K/BUW:TkxmlXDFgsOlDa0R6HWOscSR3P8UW
-
NetWire RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-