General
-
Target
ACAD4A9863D251BBB0F2724C743E0C2B51D953DB7DFF0.exe
-
Size
424KB
-
Sample
221025-qzpdhachb5
-
MD5
a809c41d8589013933ed759fe1b8f4fb
-
SHA1
1d8b8ed7e1577d314b307a39d77b51d98cde8567
-
SHA256
acad4a9863d251bbb0f2724c743e0c2b51d953db7dff041db7a0ae6f607622f8
-
SHA512
721883b08195b40875aba7c150970583845b1677d3158e7d7ccbc751d0203888861056206716ad29c4648297a03f11ca83b61b988d640520868e48018f6b3581
-
SSDEEP
6144:5ddVrIvYRJOa0tJSyOz6F59AMSIm9/4B/2omAkeKAqfIJyp9V/o9aM:LrI0O1+yO+plGq2TOKA7Ju
Static task
static1
Behavioral task
behavioral1
Sample
ACAD4A9863D251BBB0F2724C743E0C2B51D953DB7DFF0.exe
Resource
win7-20220812-en
Malware Config
Extracted
netwire
moran101.duckdns.org:7011
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
BILLIONS $$
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Naija81,J
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
ACAD4A9863D251BBB0F2724C743E0C2B51D953DB7DFF0.exe
-
Size
424KB
-
MD5
a809c41d8589013933ed759fe1b8f4fb
-
SHA1
1d8b8ed7e1577d314b307a39d77b51d98cde8567
-
SHA256
acad4a9863d251bbb0f2724c743e0c2b51d953db7dff041db7a0ae6f607622f8
-
SHA512
721883b08195b40875aba7c150970583845b1677d3158e7d7ccbc751d0203888861056206716ad29c4648297a03f11ca83b61b988d640520868e48018f6b3581
-
SSDEEP
6144:5ddVrIvYRJOa0tJSyOz6F59AMSIm9/4B/2omAkeKAqfIJyp9V/o9aM:LrI0O1+yO+plGq2TOKA7Ju
-
NetWire RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Loads dropped DLL
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Suspicious use of SetThreadContext
-