General
-
Target
ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7
-
Size
231KB
-
Sample
230129-1c7lnsfa3v
-
MD5
85d1383f02b7ce7df6c885b26dec358f
-
SHA1
36b4d98651e805ae6221a34fc32ded9e29dc2202
-
SHA256
ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7
-
SHA512
9fe7ed08fea7256de6def7d3b7848f099753a4ed6365dc8fc3871d5c355ae12870d4a8858897e7a5537080ff2471274f40bb8746755ed2e55e40665edbc9f568
-
SSDEEP
6144:sIQQvbRHrYO7oHO7ADvifoFHig7wK2zU0uNE22Sv:VBThrYO7UzQEXwK2zU0uNE22S
Static task
static1
Behavioral task
behavioral1
Sample
ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
netwire
haija.mine.nu:9999
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
Aegistools
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
qays1122
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7
-
Size
231KB
-
MD5
85d1383f02b7ce7df6c885b26dec358f
-
SHA1
36b4d98651e805ae6221a34fc32ded9e29dc2202
-
SHA256
ef76e88f9445dbe003be780a299e2bf9a4d50ad4b8b85332d213dbf4d38e8de7
-
SHA512
9fe7ed08fea7256de6def7d3b7848f099753a4ed6365dc8fc3871d5c355ae12870d4a8858897e7a5537080ff2471274f40bb8746755ed2e55e40665edbc9f568
-
SSDEEP
6144:sIQQvbRHrYO7oHO7ADvifoFHig7wK2zU0uNE22Sv:VBThrYO7UzQEXwK2zU0uNE22S
Score10/10-
NetWire RAT payload
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-