Netwire_RAT_03-09-2019

#Netwire #RAT #Trojan #CVE-2017-11882
------------------------------------------
03-09-2019
------------------------------------------
Main object- "696d1903438d3f759f0918b333278c15c06e3911e68906f2399cc25f032980dd.bin.gz"
	sha256	f2d8fe61d4e23a23dce3ea404f113e18a7e28880e341999e28e2c7f8de2b76d9
	sha1	65ada04a9a48588665831c01a30fccadfe7b527c
	md5	5e6a519791becf570fb108fdf5e36794
Dropped executable file
	sha256	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\in[1].exe	7d4d8865645ff31d355caceae25f90d21d3276ff55bb327266a80792688c9188
	sha256	C:\Users\admin\AppData\Local\Temp\37511436\drh.exe	fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b
DNS requests
	domain	reliablespaces.com
	domain	www.reliablespaces.com
	domain	info1.nowddns.com
Connections
	ip	79.134.225.61
	ip	103.13.242.34
HTTP/HTTPS requests
	url	http://reliablespaces.com/in.exe
	url	http://www.reliablespaces.com/in.exe