General
-
Target
tax invoice.img
-
Size
1.6MB
-
Sample
220920-kng76acdh2
-
MD5
2c7c91e69821eaaf9c547fac79a52e66
-
SHA1
451dfda2c613538a7ad69c19ef6bb467f256419d
-
SHA256
b0e07a068890fe021969958f20db17946378f41bc603a628c6d8a54d0b0a34fb
-
SHA512
7fcc809f4318e648dc2936f192794dd5e5441c0e33e1f6a573c405699f076950aa6d3c8e598dd82de4708dc16d75c72b8b91bb647e038f13cf0a8a7730465568
-
SSDEEP
12288:lkNjmlx1fDFztKfCWxWrFoT5VPBDwvTgnRcPLHWO4Tyw4N9ER5pzh9K/BUW:lkxmlXDFgsOlDa0R6HWOscSR3P8UW
Static task
static1
Behavioral task
behavioral1
Sample
TAX_INVO.exe
Resource
win7-20220812-en
Malware Config
Targets
-
-
Target
TAX_INVO.EXE
-
Size
1.0MB
-
MD5
e48d3684ab9ae8701aa591397b5d333c
-
SHA1
9137bd3415377d3e77b0dc8d4e69b22ea4b473a1
-
SHA256
9fe290fed627fb78a5f4f92a4e479c63a6b8a2d614fa173bb37d474300c102e6
-
SHA512
d33641ad902718b686a2d334889d00f516363dae766824edacd6412c0f08c4db63a555ad464cb68ff855d33ef27d0fbdfcb2867fab1e4b2e00c23afbbc10328f
-
SSDEEP
12288:TkNjmlx1fDFztKfCWxWrFoT5VPBDwvTgnRcPLHWO4Tyw4N9ER5pzh9K/BUW:TkxmlXDFgsOlDa0R6HWOscSR3P8UW
-
NetWire RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-