General
-
Target
1732-69-0x0000000000400000-0x0000000000433000-memory.dmp
-
Size
204KB
-
MD5
736950a44f4212e790a4bb8d278e6599
-
SHA1
2fb2d7c241ce66875311cb382f07f3896ff37950
-
SHA256
5503bc30124ce108452833d6cdc9f8e0bd7d11716688c28f2c393697ddf3fb39
-
SHA512
bb582521992f24ad6fa3d2da999f45fe0cadbf257fa84bf6ecd333aace7189933ef5903bb8d4145acee95fab9baff85f10f6aefd65e75fd9d7dce805c6914f5f
-
SSDEEP
3072:S3bwUUCZjY/UURTbaiceGUlzFr0qOnZEcsx8VLJdYMSMqqD:S3kUjJY/fRT+iceGUlzFruZdJdzxqqD
Score
10/10
Malware Config
Extracted
Family
netwire
C2
zonedx.ddns.net:3360
85.209.134.105:3360
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
offline_keylogger
true
-
password
Password9090
-
registry_autorun
true
-
startup_name
NetWire
-
use_mutex
false
Signatures
-
NetWire RAT payload 1 IoCs
-
Netwire family
Files
-
1732-69-0x0000000000400000-0x0000000000433000-memory.dmp
Headers
Sections