General

  • Target

    Request Quote_PDF.js

  • Size

    413KB

  • Sample

    220915-je9qdagaar

  • MD5

    b05187342160e8e8d6cffbac2a5cfa0c

  • SHA1

    449ebfb89d81b749077693d7cc95192a782dbc80

  • SHA256

    de11ed010bbdd5156686ddf9e7d970d31a2960c63dfae6b851e19199f7aef893

  • SHA512

    176291d5eb7dca6242f89a5396ddf7497c617da30efdb910297d922b3f7751566a3a652ad3c5c060e6c0bddcd1e65e9e140c420f60004179d5d4de4aeb87960c

  • SSDEEP

    6144:gRjCah1B3EeXinEvc7Txpv14FE7W3+6EuNfeaU+spDEGXbTVAHX+uo:gRWQTvc7TxZaFEj6ESfpMNJ

Malware Config

Targets

    • Target

      Request Quote_PDF.js

    • Size

      413KB

    • MD5

      b05187342160e8e8d6cffbac2a5cfa0c

    • SHA1

      449ebfb89d81b749077693d7cc95192a782dbc80

    • SHA256

      de11ed010bbdd5156686ddf9e7d970d31a2960c63dfae6b851e19199f7aef893

    • SHA512

      176291d5eb7dca6242f89a5396ddf7497c617da30efdb910297d922b3f7751566a3a652ad3c5c060e6c0bddcd1e65e9e140c420f60004179d5d4de4aeb87960c

    • SSDEEP

      6144:gRjCah1B3EeXinEvc7Txpv14FE7W3+6EuNfeaU+spDEGXbTVAHX+uo:gRWQTvc7TxZaFEj6ESfpMNJ

    • NetWire RAT payload

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks