General
-
Target
30de906d4955a6863bc9b45602a5ed3c.bin
-
Size
570KB
-
Sample
230131-jewthshb5w
-
MD5
10deafe4dd8ea4228c4ad3779f33c9cd
-
SHA1
7322e33964c08865be380d54128ece1f67caaa3a
-
SHA256
f141a6c95da5c69b60f9ee713ea9e00182dab9a74156a504b4303b62211abe12
-
SHA512
d5470f48f4d591b4b2f525f7d562d2d2116b0d58ab77cd7b30efcbdf110c4962db2dca02d1ae43364cf7a85c0d5d04282b2a92c63448c453ef886c5a8c8e095c
-
SSDEEP
12288:R0M09Td6QrK+K2Dr4VDKhh8O13JMZqKsyCepgOmr46LSwjZQbbAC/:KM0ldK+dDr4shh8O13GIWCepAE6LSw2h
Static task
static1
Behavioral task
behavioral1
Sample
868ec037a1d8de69e0b32853f957d2b9329877fa0b1d99c0fdb07952c61fd6c2.exe
Resource
win7-20221111-en
Malware Config
Extracted
netwire
212.193.30.230:3363
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
HostId-%Rand%
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
false
-
offline_keylogger
true
-
password
Password@2
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
868ec037a1d8de69e0b32853f957d2b9329877fa0b1d99c0fdb07952c61fd6c2.exe
-
Size
875KB
-
MD5
30de906d4955a6863bc9b45602a5ed3c
-
SHA1
74659c613ad6dde0cdb47ea69bc737c48e443bea
-
SHA256
868ec037a1d8de69e0b32853f957d2b9329877fa0b1d99c0fdb07952c61fd6c2
-
SHA512
8061466839701f69dfbdefc3ee0573c3126c91621894c37a53a5b91a02c1ef4476d39da4e8743189da9e43ef5ae8941724f7f3cfb09efa7079025b526b439687
-
SSDEEP
12288:BErIIoMZAYCu9gpDLoQV7EvknemE0IvyNnJV4ilzP3X:WVOKSpD59Es7bIaNz4OP3X
-
NetWire RAT payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext
-