Overview

overview

10

Static

static

b536b2e629...40.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b536b2e629251420a9cd824acd7e955540258c78ae7a14b10a787caee251dd40

  • Size

    523KB

  • Sample

    210727-tlka6chyyj

  • MD5

    ff050a24b54251f10bbe17f6890856d7

  • SHA1

    31edaa2a4f2774f172ec9fd928e2e5277cfeaa04

  • SHA256

    b536b2e629251420a9cd824acd7e955540258c78ae7a14b10a787caee251dd40

  • SHA512

    ebf331b397b4eb643b8aad509b433d41e37dc31f3b4050eddc5c4b003b65b2c04538a280c6fee3d227bed13007aac23b88265fdbb6b8f348b044dc09d41d1e3f

Score
10/10
netwirebotnetevasionratstealer

Malware Config

Targets

    • Target

      b536b2e629251420a9cd824acd7e955540258c78ae7a14b10a787caee251dd40

    • Size

      523KB

    • MD5

      ff050a24b54251f10bbe17f6890856d7

    • SHA1

      31edaa2a4f2774f172ec9fd928e2e5277cfeaa04

    • SHA256

      b536b2e629251420a9cd824acd7e955540258c78ae7a14b10a787caee251dd40

    • SHA512

      ebf331b397b4eb643b8aad509b433d41e37dc31f3b4050eddc5c4b003b65b2c04538a280c6fee3d227bed13007aac23b88265fdbb6b8f348b044dc09d41d1e3f

    Score
    10/10
    netwirebotnetevasionratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks