General
-
Target
1516-69-0x0000000000400000-0x0000000000433000-memory.dmp
-
Size
204KB
-
MD5
424ad5fe27281ab62b6724a638cfbcc7
-
SHA1
0bcace635f4f873998dfa10e34de12485f9b1f64
-
SHA256
24f2bafb788eab2ace8621eacd69ead2162b5308ab24576ae86c45239279ea3b
-
SHA512
40113d1a63b618d82b3472cce3117c554e5aa9c1f29c8649b5f63d00e046982f252ccdcbcf231ec74fe672a9a500f32ba4e90e017509a878b862917772cd32f0
-
SSDEEP
3072:S3bwUUCZjY/UURTbaiceGUlzFr0qOnZEcsx8VLJDYMSMqqD:S3kUjJY/fRT+iceGUlzFruZdJDzxqqD
Score
10/10
Malware Config
Extracted
Family
netwire
C2
212.193.30.230:3363
Attributes
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@2
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 1 IoCs
-
Netwire family
Files
-
1516-69-0x0000000000400000-0x0000000000433000-memory.dmp
Headers
Sections