Overview

overview

10

Static

static

10

OrderNo-202000125.exe

windows7_x64

10

OrderNo-202000125.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OrderNo-202000125.exe

  • Size

    836KB

  • Sample

    210118-xe5lt3trcn

  • MD5

    8768f782c4b33518acab30685d3106dc

  • SHA1

    41fbeffbc5853d803a64b3a00b2b95fce72d0bbc

  • SHA256

    cb9713e99535b6589f62d352c0a22488ae19d4b02df7f33e3fc052e9c8414481

  • SHA512

    6e654f085f7047638d2720e9b58607558e273f04a52231ae05fee67ed73f4b061ef0638089fa72a321a99a787cf3f4cc1ae471c7f3bc5bb064001aec0faa9344

Score
10/10
modiloadernetwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      OrderNo-202000125.exe

    • Size

      836KB

    • MD5

      8768f782c4b33518acab30685d3106dc

    • SHA1

      41fbeffbc5853d803a64b3a00b2b95fce72d0bbc

    • SHA256

      cb9713e99535b6589f62d352c0a22488ae19d4b02df7f33e3fc052e9c8414481

    • SHA512

      6e654f085f7047638d2720e9b58607558e273f04a52231ae05fee67ed73f4b061ef0638089fa72a321a99a787cf3f4cc1ae471c7f3bc5bb064001aec0faa9344

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks