Extracted

• • Target
    290546249.xls
  • Size 411KB
  • SHA256 b2159f5f6752404355be70f1b882482c9996f0c4e809b565a1b1ce8705348d88
  • MD5 b868ef8972b158c96b414662ed2bf51d
  • SHA1 6823ae4dd686422f4716c6a81a496c9b8ee37906
  • SHA512 d3fed8a54767e2e9ea01e036ba362c1c04a13a4b36e4985c91e4fcbde3c61e89a7611d55672bbd60b7fce0c72754ae57884b6bad967338b66b7f50297becb995
  • MD5 SHA1 SHA512

  Score

  10^/10

  ratbotnetstealernetwire

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blacklisted process makes network request

  • Suspicious use of SetThreadContext

  behavioral1behavioral2