General
-
Target
1212-68-0x0000000000280000-0x0000000000902000-memory.dmp
-
Size
6.5MB
-
MD5
1dd74eb8ad4854defa84b8fdec02e572
-
SHA1
453b5cb000bf4379f727989445e1b5efda476b03
-
SHA256
6ef119233eeafcaaa21ef70d82a2b093d55353c6b0c3ed0efb0ee191e0bdf6a9
-
SHA512
96394bb0f26bd5f8d2b2cd2935b8d0392a423bed25c2cde5aabf191a446f2d14a8f30014309ac45345a89463dd480c7f349baa15e67cefd9acde70a216455805
-
SSDEEP
3072:7OLPUPSuVr3lo7c+nNX7Ub6p/SfGvljMrv4M8HCvRcuNL3JYMDMqqDvFf:7O7U6uVbZKIGvljMr78inJzwqqDvFf
Score
10/10
Malware Config
Extracted
Family
netwire
C2
37.0.14.206:3384
Attributes
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
offline_keylogger
true
-
password
Password234
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 1 IoCs
-
Netwire family
Files
-
1212-68-0x0000000000280000-0x0000000000902000-memory.dmp
Headers
Sections