Overview

overview

10

Static

static

Bank_details.exe

windows7_x64

10

Bank_details.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Bank_details.exe

  • Size

    2.7MB

  • Sample

    200707-yzh238zlfx

  • MD5

    9b878d9209ed90815bc3bc06a842dd4c

  • SHA1

    84b95b2e05bb14212c6688d4a82486bc1932dae6

  • SHA256

    a521bd7e14bd3f373c03a13487b5ec4156c9b59bcf7751db5b6fded58d4825d3

  • SHA512

    09171d02e63504a6b84ab9b7c10f38ad2f3792c3a0ddbf4d9268edc3ee85a90c5c2cff675683577a20a93432eb63ebd079286ddb6c8e470da82799aa32277f9a

Score
10/10
netwirebotnetpersistencestealer

Malware Config

Targets

    • Target

      Bank_details.exe

    • Size

      2.7MB

    • MD5

      9b878d9209ed90815bc3bc06a842dd4c

    • SHA1

      84b95b2e05bb14212c6688d4a82486bc1932dae6

    • SHA256

      a521bd7e14bd3f373c03a13487b5ec4156c9b59bcf7751db5b6fded58d4825d3

    • SHA512

      09171d02e63504a6b84ab9b7c10f38ad2f3792c3a0ddbf4d9268edc3ee85a90c5c2cff675683577a20a93432eb63ebd079286ddb6c8e470da82799aa32277f9a

    Score
    10/10
    persistencebotnetstealernetwire

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Adds Run entry to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks