General

  • Target

    f7973974b06ffb1c2d29c79e2c8596679eaf3c99bf5328bb948053006ea78f7bN.exe

  • Size

    160KB

  • Sample

    250104-kpl8haskcz

  • MD5

    6dcb2cbe83abe9f34e4d9cfdedf88500

  • SHA1

    3fe86d41d9ef6705f924e6ee68b2347cde61ca46

  • SHA256

    f7973974b06ffb1c2d29c79e2c8596679eaf3c99bf5328bb948053006ea78f7b

  • SHA512

    b6479a9a9cc83a25d49a46e0563574e14fd62c8e25f7b6937d6a9c7178d079decd78e4dc7b14aeb260b0557b6c04970d807b295f6aa9d0acecc68df97c89253d

  • SSDEEP

    3072:zOzPcXa+ND32eioGHlz8rnAE0HCXh0edLv/YMjMqqDvFf:zOTcK+NrRioGHlz8rz0i//zQqqDvFf

Malware Config

Extracted

Family

netwire

C2

66.154.103.106:13374

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    myphone

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      f7973974b06ffb1c2d29c79e2c8596679eaf3c99bf5328bb948053006ea78f7bN.exe

    • Size

      160KB

    • MD5

      6dcb2cbe83abe9f34e4d9cfdedf88500

    • SHA1

      3fe86d41d9ef6705f924e6ee68b2347cde61ca46

    • SHA256

      f7973974b06ffb1c2d29c79e2c8596679eaf3c99bf5328bb948053006ea78f7b

    • SHA512

      b6479a9a9cc83a25d49a46e0563574e14fd62c8e25f7b6937d6a9c7178d079decd78e4dc7b14aeb260b0557b6c04970d807b295f6aa9d0acecc68df97c89253d

    • SSDEEP

      3072:zOzPcXa+ND32eioGHlz8rnAE0HCXh0edLv/YMjMqqDvFf:zOTcK+NrRioGHlz8rz0i//zQqqDvFf

    • NetWire RAT payload

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    • Netwire family

MITRE ATT&CK Enterprise v15

Tasks