General
-
Target
40217d077e10762829d40552f060147eaf9235d03a1fc4581fbc80dfd931805a
-
Size
185KB
-
Sample
221122-xm2avshb6s
-
MD5
2033e4aafe2162ecc88f30ef5d30ef66
-
SHA1
9a5344fdf5f6f72aaff37aa4422caec310bce0a3
-
SHA256
40217d077e10762829d40552f060147eaf9235d03a1fc4581fbc80dfd931805a
-
SHA512
c844562a67e797cf825a39e9b93d2ccd505da31c66991a2067990a9ac3d3b2c8bf2ce943ef81c31a70c0c069cdb6250dc65ce3403ba447fb28cb3bee0360116e
-
SSDEEP
3072:CnEWyU+dea8BNhBuvmJFEIG3kIgyS9RJySqKgP:CEW1+deDc6F6kVVybz
Static task
static1
Behavioral task
behavioral1
Sample
40217d077e10762829d40552f060147eaf9235d03a1fc4581fbc80dfd931805a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
40217d077e10762829d40552f060147eaf9235d03a1fc4581fbc80dfd931805a.exe
Resource
win10v2004-20221111-en
Malware Config
Targets
-
-
Target
40217d077e10762829d40552f060147eaf9235d03a1fc4581fbc80dfd931805a
-
Size
185KB
-
MD5
2033e4aafe2162ecc88f30ef5d30ef66
-
SHA1
9a5344fdf5f6f72aaff37aa4422caec310bce0a3
-
SHA256
40217d077e10762829d40552f060147eaf9235d03a1fc4581fbc80dfd931805a
-
SHA512
c844562a67e797cf825a39e9b93d2ccd505da31c66991a2067990a9ac3d3b2c8bf2ce943ef81c31a70c0c069cdb6250dc65ce3403ba447fb28cb3bee0360116e
-
SSDEEP
3072:CnEWyU+dea8BNhBuvmJFEIG3kIgyS9RJySqKgP:CEW1+deDc6F6kVVybz
Score10/10-
NetWire RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-