Overview

overview

10

Static

static

8

797002f478...78.exe

windows7_x64

10

797002f478...78.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    797002f4783a2619b976b112dd695a8b904f9abdbb73dd2505ee5c4b594d0578

  • Size

    653KB

  • Sample

    210513-epz3venv1n

  • MD5

    f461400d378c5f840b7931457c81102e

  • SHA1

    ce48c96621003fc34a0d0a2d521d9e9947bf58ed

  • SHA256

    797002f4783a2619b976b112dd695a8b904f9abdbb73dd2505ee5c4b594d0578

  • SHA512

    ea87170ab9d7c4e54c678d39c764a5bdad5953b7395eca6a7c6391727e0fc3b842d3bd93135956f32a468678981b03ee305dba852d8aefb28ae93926c19e35f1

Score
10/10
netwirebotnetratstealerupx

Malware Config

Targets

    • Target

      797002f4783a2619b976b112dd695a8b904f9abdbb73dd2505ee5c4b594d0578

    • Size

      653KB

    • MD5

      f461400d378c5f840b7931457c81102e

    • SHA1

      ce48c96621003fc34a0d0a2d521d9e9947bf58ed

    • SHA256

      797002f4783a2619b976b112dd695a8b904f9abdbb73dd2505ee5c4b594d0578

    • SHA512

      ea87170ab9d7c4e54c678d39c764a5bdad5953b7395eca6a7c6391727e0fc3b842d3bd93135956f32a468678981b03ee305dba852d8aefb28ae93926c19e35f1

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks