wraithnet | cce67fd74ab49b4e3b4afc8787aa74554784c8fb3af7198b529523dff451e7f6[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
cce67fd74ab49b4e3b4afc8787aa74554784c8fb3af7198b529523dff451e7f6.zip
Size 413KB
Sample251124-2mfrdaxjbn
SHA256 6040fba96553bf412ea140ba1dbba0129d743ce6d21aab0f8bee2a182eee673d
MD5 971c23cb92d2f6fcb0151a39debb28b4
SHA1 2b8641b9cd5cb7fce439a754d50bd49351de0db6
SHA512 552643b0cb95e2a275756b4b423a30d2299d227c4a6f8c231888b25045c3c070b7bfafd4797190f42686826f1f7807f43c3f80278e08815d22696770b88b49b1
SSDEEP 12288:2FLahzuUwk6QRf6XhvNb8+3npDjHLBvmx9yBdOx:wa0zk9KtNg+5Tlyd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wraithnet

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
static1/unpack001/cce67fd74ab49b4e3b4afc8787aa74554784c8fb3af7198b529523dff451e7f6.exe	disable_win_def

Detects WraithNET payload 1 IoCs

resource	yara_rule
static1/unpack001/cce67fd74ab49b4e3b4afc8787aa74554784c8fb3af7198b529523dff451e7f6.exe	family_wraithnet

Wraithnet family
wraithnet

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cce67fd74ab49b4e3b4afc8787aa74554784c8fb3af7198b529523dff451e7f6.exe

File Explorer

cce67fd74ab49b4e3b4afc8787aa74554784c8fb3af7198b529523dff451e7f6.zip

.zip 413KB
cce67fd74ab49b4e3b4afc8787aa74554784c8fb3af7198b529523dff451e7f6.exe

.exe 1.2MB

cce67fd74ab49b4e3b4afc8787aa74554784c8fb3af7198b529523dff451e7f6.zip

SHA256 6040fba96553bf412ea140ba1dbba0129d743ce6d21aab0f8bee2a182eee673d
MD5 971c23cb92d2f6fcb0151a39debb28b4
SHA1 2b8641b9cd5cb7fce439a754d50bd49351de0db6
SHA512 552643b0cb95e2a275756b4b423a30d2299d227c4a6f8c231888b25045c3c070b7bfafd4797190f42686826f1f7807f43c3f80278e08815d22696770b88b49b1
SSDEEP 12288:2FLahzuUwk6QRf6XhvNb8+3npDjHLBvmx9yBdOx:wa0zk9KtNg+5Tlyd
MD5 SHA1 SHA512 SSDEEP

Password

infected

cce67fd74ab49b4e3b4afc8787aa74554784c8fb3af7198b529523dff451e7f6.exe

SHA256 cce67fd74ab49b4e3b4afc8787aa74554784c8fb3af7198b529523dff451e7f6
MD5 090ced3bbde0c008c3685657383c70f6
SHA1 481a68daf3460745bb9b257ddcb48a4dbea7db80
SHA512 249225c6dacfcf2042faae004827f27c9abd1df77637038d3a50ebaf9f550c635ec247fb9335f941b8e6c7def918fdcf3a04728014e98a4092b5652156aa688a
SSDEEP 12288:9zB7JvOHde81v2pRHGhrbJSiA4+AZDonxcOm8I34Osmor711lW:9zB7JvcdHv2/GhrbJSip+ACeMbOix1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Detects WraithNET payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4119

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

935KB

Virtual Size

934KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cce67fd74ab49b4e3b4afc8787aa74554784c8fb3af7198b529523dff451e7f6.zip

cce67fd74ab49b4e3b4afc8787aa74554784c8fb3af7198b529523dff451e7f6.exe

generic