General
-
Target
22ce18519278ff29a5be2234046ab841.exe
-
Size
1009KB
-
Sample
221027-keqg6sbee4
-
MD5
22ce18519278ff29a5be2234046ab841
-
SHA1
55bc3eef779242d725b1e714b68b3af0ab2c9dc4
-
SHA256
a21c8ef38b35eda08af936729863498ead8f750de997bc2d55ff9da429872e33
-
SHA512
5c593a302296201c195772e350ef652087e5064833b3562523000fd6b4ded2fa0fb387eece3bde95ccf7918e091b5aa3a55ccb15401912ac13c597c6aeea79c0
-
SSDEEP
24576:OxU9yhM92fhwRIcseNhxZlmF14/H/TMEVoCN:mhMofmueNk+fTMioC
Static task
static1
Behavioral task
behavioral1
Sample
22ce18519278ff29a5be2234046ab841.exe
Resource
win7-20220812-en
Malware Config
Extracted
netwire
212.193.30.230:3363
212.193.30.230:3362
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Cantbeme@1
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
22ce18519278ff29a5be2234046ab841.exe
-
Size
1009KB
-
MD5
22ce18519278ff29a5be2234046ab841
-
SHA1
55bc3eef779242d725b1e714b68b3af0ab2c9dc4
-
SHA256
a21c8ef38b35eda08af936729863498ead8f750de997bc2d55ff9da429872e33
-
SHA512
5c593a302296201c195772e350ef652087e5064833b3562523000fd6b4ded2fa0fb387eece3bde95ccf7918e091b5aa3a55ccb15401912ac13c597c6aeea79c0
-
SSDEEP
24576:OxU9yhM92fhwRIcseNhxZlmF14/H/TMEVoCN:mhMofmueNk+fTMioC
-
NetWire RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-