Overview

overview

10

Static

static

10

C5A6211FE9...F5.exe

windows7_x64

10

C5A6211FE9...F5.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    C5A6211FE9AB12EB4D85BFB61E9495F5.exe

  • Size

    160KB

  • Sample

    210701-9lw45dbjye

  • MD5

    c5a6211fe9ab12eb4d85bfb61e9495f5

  • SHA1

    635d8c769477ea6fe801544fcfbb50e70011a29d

  • SHA256

    cbf703cf139fbeffc482036fed72e4bcae042a92c769cbb3de5219209b56553f

  • SHA512

    96938398102e9c3d802d708c248832e5eea1ad0229c3e296d6260e3144ae9f8d916d415b800caca20655e7956cacf438ae692c254e3d10aa509d12bf46ba9d74

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

netno.ddns.net:6577

ddns.dbcdubai.com:6577

netsecond.duckdns.org:6577
Attributes
  • activex_autorun

    false

  • activex_key

  • copy_executable

    false

  • delete_original

    false

  • host_id

    OJ

  • install_path

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    oCTboYgC

  • offline_keylogger

    true

  • password

    Trinidado1@

  • registry_autorun

    false

  • startup_name

  • use_mutex

    true

Targets

    • Target

      C5A6211FE9AB12EB4D85BFB61E9495F5.exe

    • Size

      160KB

    • MD5

      c5a6211fe9ab12eb4d85bfb61e9495f5

    • SHA1

      635d8c769477ea6fe801544fcfbb50e70011a29d

    • SHA256

      cbf703cf139fbeffc482036fed72e4bcae042a92c769cbb3de5219209b56553f

    • SHA512

      96938398102e9c3d802d708c248832e5eea1ad0229c3e296d6260e3144ae9f8d916d415b800caca20655e7956cacf438ae692c254e3d10aa509d12bf46ba9d74

    Score
    10/10
    netwirebotnetstealer

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks