Overview

overview

10

Static

static

10

952-66-0x0...ry.exe

windows7-x64

1

952-66-0x0...ry.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    952-66-0x0000000000400000-0x000000000044F000-memory.dmp

  • Size

    316KB

  • MD5

    7dfb62921d72bf444ac0d434e246c5e3

  • SHA1

    2e065af7af13d00be927aff3431c862e1d4ee5c9

  • SHA256

    435ea051adfbc6658c4462437f7bb4e47913198609b9846b1af3b4710a2a4528

  • SHA512

    d622f05323a848013396deed497fb42c894554adbb51d2117937df7227a119955f083216dc28231fae817f0b59fa4f473e2be9ae29dae4d8d6ff0357f0553e9c

  • SSDEEP

    6144:wcCmiQfipBKWzkeHrb08rTj6aBpSYdS1wjzcoKqqD9BgIx:wcXiQfipPrb08rTj6+pGuq3bx

Score
10/10
ratnetwire

Malware Config

Extracted

Family

netwire

C2

85.31.46.78:3340

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    azaman

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 1 IoCs
    rat
  • Netwire family
    netwire

Files

  • 952-66-0x0000000000400000-0x000000000044F000-memory.dmp
    .exe windows x86


    Headers

    Sections