General
-
Target
Request Quote_PDF.js
-
Size
413KB
-
Sample
220915-je9qdagaar
-
MD5
b05187342160e8e8d6cffbac2a5cfa0c
-
SHA1
449ebfb89d81b749077693d7cc95192a782dbc80
-
SHA256
de11ed010bbdd5156686ddf9e7d970d31a2960c63dfae6b851e19199f7aef893
-
SHA512
176291d5eb7dca6242f89a5396ddf7497c617da30efdb910297d922b3f7751566a3a652ad3c5c060e6c0bddcd1e65e9e140c420f60004179d5d4de4aeb87960c
-
SSDEEP
6144:gRjCah1B3EeXinEvc7Txpv14FE7W3+6EuNfeaU+spDEGXbTVAHX+uo:gRWQTvc7TxZaFEj6ESfpMNJ
Static task
static1
Behavioral task
behavioral1
Sample
Request Quote_PDF.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Request Quote_PDF.js
Resource
win10v2004-20220812-en
Malware Config
Targets
-
-
Target
Request Quote_PDF.js
-
Size
413KB
-
MD5
b05187342160e8e8d6cffbac2a5cfa0c
-
SHA1
449ebfb89d81b749077693d7cc95192a782dbc80
-
SHA256
de11ed010bbdd5156686ddf9e7d970d31a2960c63dfae6b851e19199f7aef893
-
SHA512
176291d5eb7dca6242f89a5396ddf7497c617da30efdb910297d922b3f7751566a3a652ad3c5c060e6c0bddcd1e65e9e140c420f60004179d5d4de4aeb87960c
-
SSDEEP
6144:gRjCah1B3EeXinEvc7Txpv14FE7W3+6EuNfeaU+spDEGXbTVAHX+uo:gRWQTvc7TxZaFEj6ESfpMNJ
Score10/10-
NetWire RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-