9de81c4b0f4d76ada494588b6250165091db9f1b7e1b9cc84a4f621aafa92362

General
Target

9de81c4b0f4d76ada494588b6250165091db9f1b7e1b9cc84a4f621aafa92362

Size

644KB

Sample

210422-c4lkyjzgk2

Score
10 /10
MD5

aa7f4ac1c779a113a1f6deefe4980ae6

SHA1

7de6c7563fb13e8ae9fe682e79a2a65145aaf491

SHA256

9de81c4b0f4d76ada494588b6250165091db9f1b7e1b9cc84a4f621aafa92362

SHA512

8280cb3488f909599ecdc25517a4520320dab86a63e446cce46d045d04373d4826939bcf55088bad19dad542b5f5731bd1cee80cc3be5f4e8dc5e269bbbab230

Malware Config

Extracted

Family netwire
C2

194.5.98.97:3366

194.5.98.97:4081

194.5.98.97:3369

Attributes
activex_autorun
false
activex_key
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
install_path
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
offline_keylogger
true
password
Kemme
registry_autorun
false
startup_name
use_mutex
false
Targets
Target

9de81c4b0f4d76ada494588b6250165091db9f1b7e1b9cc84a4f621aafa92362

MD5

aa7f4ac1c779a113a1f6deefe4980ae6

Filesize

644KB

Score
10 /10
SHA1

7de6c7563fb13e8ae9fe682e79a2a65145aaf491

SHA256

9de81c4b0f4d76ada494588b6250165091db9f1b7e1b9cc84a4f621aafa92362

SHA512

8280cb3488f909599ecdc25517a4520320dab86a63e446cce46d045d04373d4826939bcf55088bad19dad542b5f5731bd1cee80cc3be5f4e8dc5e269bbbab230

Tags

Signatures

  • NetWire RAT payload

    Tags

  • Netwire

    Description

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    Tags

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Tasks

                      static1

                      behavioral1

                      10/10

                      behavioral2

                      10/10