netwire | d488a34718cf2db560dd4c62ccb5fac527cc192716c2d166a71f98abd384aba6 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SecuriteInfo.com.Worm.Autoit.BQJA.15940.32323
Size 963KB
Sample201109-cbn7hx2r2e
SHA256 d488a34718cf2db560dd4c62ccb5fac527cc192716c2d166a71f98abd384aba6
MD5 48100ae2327c512aa8e152a9bad32614
SHA1 21727f1c1c536634adb4cffa98deb4e371ebf8dc
SHA512 8299a9614732a1ea530d355110839bf1705bad5ff42914a0954384ac6169bb9e5e3cb1bb0889147b32b36ad5d20b607b9db12fef9a71fdc46739d8ca4891e5ef
MD5 SHA1 SHA512

Score

10^/10

netwire botnet rat stealer

Malware Config

Targets

- Target
  SecuriteInfo.com.Worm.Autoit.BQJA.15940.32323
- Size 963KB
- SHA256 d488a34718cf2db560dd4c62ccb5fac527cc192716c2d166a71f98abd384aba6
- MD5 48100ae2327c512aa8e152a9bad32614
- SHA1 21727f1c1c536634adb4cffa98deb4e371ebf8dc
- SHA512 8299a9614732a1ea530d355110839bf1705bad5ff42914a0954384ac6169bb9e5e3cb1bb0889147b32b36ad5d20b607b9db12fef9a71fdc46739d8ca4891e5ef
- MD5 SHA1 SHA512
Score

10^/10

netwire botnet rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

netwirebotnetratstealer