General

  • Target

    5c25844d649ccdb04b64d2d17e27088cfdc1d60b08c80b3d88cded1f30b86e6e

  • Size

    187KB

  • Sample

    221128-dvr8dafb8v

  • MD5

    e171aec3cf318e43d3724c38006b4547

  • SHA1

    664013e1e14fcc98fff85cc30557decf5fdcb353

  • SHA256

    5c25844d649ccdb04b64d2d17e27088cfdc1d60b08c80b3d88cded1f30b86e6e

  • SHA512

    dc96c7a4b8402d36f5a44bf387f6639f07814afed120ffd944c9c169d934c0abb458b7893e5e6dbb6d2562f72949cd286868c869518bb07150c4d4b82daa0ac1

  • SSDEEP

    3072:r2FUbtpT8ST1rybZJ93DrvF3EvCLlLeDj4/2+kjdW5895lHgPSxtEOTZ:rxV8Sprybb9T53Dc4G5H95lHgPSxt7TZ

Malware Config

Targets

    • Target

      5c25844d649ccdb04b64d2d17e27088cfdc1d60b08c80b3d88cded1f30b86e6e

    • Size

      187KB

    • MD5

      e171aec3cf318e43d3724c38006b4547

    • SHA1

      664013e1e14fcc98fff85cc30557decf5fdcb353

    • SHA256

      5c25844d649ccdb04b64d2d17e27088cfdc1d60b08c80b3d88cded1f30b86e6e

    • SHA512

      dc96c7a4b8402d36f5a44bf387f6639f07814afed120ffd944c9c169d934c0abb458b7893e5e6dbb6d2562f72949cd286868c869518bb07150c4d4b82daa0ac1

    • SSDEEP

      3072:r2FUbtpT8ST1rybZJ93DrvF3EvCLlLeDj4/2+kjdW5895lHgPSxtEOTZ:rxV8Sprybb9T53Dc4G5H95lHgPSxt7TZ

    • NetWire RAT payload

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks