General
-
Target
e36f34ebc8254248243141369fdf7634_JaffaCakes118
-
Size
301KB
-
Sample
240915-1smansthkb
-
MD5
e36f34ebc8254248243141369fdf7634
-
SHA1
7af20c7e8749f921b5f1772c74afbbb49e00a00e
-
SHA256
c08730900392b5a5a9e62986b2512756d6a9ebca6f19f7b00c9dcb2c57f618c5
-
SHA512
d505b74b1422167e67e77c4fdc85b7ef8c4ab0bf4dc4cc501d7ecaf20ce3875f99c90887004993eb073aa78be4c3b2497dfab4e1f7377a54e48ab125b8649ebd
-
SSDEEP
6144:4vVVholI5qLJ6FOIYzzNNttQTqvfOURUbHbv+lDAA:MDholIQkUI+NFQT6W9HbWdAA
Malware Config
Extracted
netwire
wealthyman.ddns.net:39560
-
activex_autorun
false
-
copy_executable
false
-
delete_original
false
-
host_id
sunshineslisa
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Targets
-
-
Target
e36f34ebc8254248243141369fdf7634_JaffaCakes118
-
Size
301KB
-
MD5
e36f34ebc8254248243141369fdf7634
-
SHA1
7af20c7e8749f921b5f1772c74afbbb49e00a00e
-
SHA256
c08730900392b5a5a9e62986b2512756d6a9ebca6f19f7b00c9dcb2c57f618c5
-
SHA512
d505b74b1422167e67e77c4fdc85b7ef8c4ab0bf4dc4cc501d7ecaf20ce3875f99c90887004993eb073aa78be4c3b2497dfab4e1f7377a54e48ab125b8649ebd
-
SSDEEP
6144:4vVVholI5qLJ6FOIYzzNNttQTqvfOURUbHbv+lDAA:MDholIQkUI+NFQT6W9HbWdAA
Score10/10-
NetWire RAT payload
-
Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-