General
-
Target
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d
-
Size
806KB
-
Sample
221127-cftl8afd9v
-
MD5
4fd6408ed28576790741bafdd1fcab49
-
SHA1
e17713b3e2751288bb12e16e4b45d95593faeb38
-
SHA256
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d
-
SHA512
ab3894fdf60f01529c44f4b27784ac8963f2df3e9589d15603a5417c88dc83b5ae31a09a17cf6eada2e3907b36317670f8ce8c8a61b2afe83bf777e096256558
-
SSDEEP
12288:zhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a5evi/r9xbcrLQWw0D8:5RmJkcoQricOIQxiZY1ia5eOEQW3D8
Static task
static1
Behavioral task
behavioral1
Sample
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d.exe
Resource
win7-20220812-en
Malware Config
Targets
-
-
Target
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d
-
Size
806KB
-
MD5
4fd6408ed28576790741bafdd1fcab49
-
SHA1
e17713b3e2751288bb12e16e4b45d95593faeb38
-
SHA256
33e1643b09d8120a840a9681e45b683bd78eccb133be44839d264155b498175d
-
SHA512
ab3894fdf60f01529c44f4b27784ac8963f2df3e9589d15603a5417c88dc83b5ae31a09a17cf6eada2e3907b36317670f8ce8c8a61b2afe83bf777e096256558
-
SSDEEP
12288:zhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4a5evi/r9xbcrLQWw0D8:5RmJkcoQricOIQxiZY1ia5eOEQW3D8
-
NetWire RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-