General
-
Target
Payment Receipt.exe
-
Size
992KB
-
Sample
221110-z8fmdsgbcp
-
MD5
7d39f04fbba87f0cae773a8d4b1a591b
-
SHA1
965ea909e8bda5e2c4934115d73062dc5947918d
-
SHA256
1d02d9cb143c8c20ccc2e47bd8e9bb78a6a0fcade93db78c227a33a92a3c30e7
-
SHA512
8617990532ea5d4158434fe6229697d4b9ef8c3c9537fa30908fcd7af81afe15a02fbf5b0f4fd14ae38a97a3a428c901a4b11a6cd34864299afeb5d8f6571582
-
SSDEEP
12288:S9k6w+/jgepcoxTlFvJ70WZkT4GHBLWgKx+kiEQ4CxAab1r3LPH61uQRaKaJZOwO:S9kcNDwYaLWVx+kmmK1rrHuraK4OwO
Static task
static1
Behavioral task
behavioral1
Sample
Payment Receipt.exe
Resource
win7-20220812-en
Malware Config
Extracted
netwire
212.193.30.230:3363
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@2
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
Payment Receipt.exe
-
Size
992KB
-
MD5
7d39f04fbba87f0cae773a8d4b1a591b
-
SHA1
965ea909e8bda5e2c4934115d73062dc5947918d
-
SHA256
1d02d9cb143c8c20ccc2e47bd8e9bb78a6a0fcade93db78c227a33a92a3c30e7
-
SHA512
8617990532ea5d4158434fe6229697d4b9ef8c3c9537fa30908fcd7af81afe15a02fbf5b0f4fd14ae38a97a3a428c901a4b11a6cd34864299afeb5d8f6571582
-
SSDEEP
12288:S9k6w+/jgepcoxTlFvJ70WZkT4GHBLWgKx+kiEQ4CxAab1r3LPH61uQRaKaJZOwO:S9kcNDwYaLWVx+kmmK1rrHuraK4OwO
-
NetWire RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-