netwire | 85f2132d070df7e82193663b26d0bc0bc0a1b3d0d7f799beadf22ca845f771df

General

Target
85f2132d070df7e82193663b26d0bc0bc0a1b3d0d7f799beadf22ca845f771df
Size 204KB
Sample220217-abbvhaefe2
SHA256 85f2132d070df7e82193663b26d0bc0bc0a1b3d0d7f799beadf22ca845f771df
MD5 5f48f6b8ce75117ee330197617143120
SHA1 1eb89c84a8dab8f8d5a72878e3dc6a78cdd727ee
SHA512 e945e390973f184c871b945868b1a64ee82cd043e2ee942319a488ad2813a96dc1e9a50b50dc57d5dbdac2d17ff76617626418946238818601b8b43398f1d7e8
SSDEEP 3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLv6RYMjMqqDRupFf:jOTcK+NrRioGHlz8rz0i/kzQqqDgpFf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat netwire

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
sample	netwire

Netwire family
netwire

File Explorer

85f2132d070df7e82193663b26d0bc0bc0a1b3d0d7f799beadf22ca845f771df

.exe 204KB

85f2132d070df7e82193663b26d0bc0bc0a1b3d0d7f799beadf22ca845f771df

SHA256 85f2132d070df7e82193663b26d0bc0bc0a1b3d0d7f799beadf22ca845f771df
MD5 5f48f6b8ce75117ee330197617143120
SHA1 1eb89c84a8dab8f8d5a72878e3dc6a78cdd727ee
SHA512 e945e390973f184c871b945868b1a64ee82cd043e2ee942319a488ad2813a96dc1e9a50b50dc57d5dbdac2d17ff76617626418946238818601b8b43398f1d7e8
SSDEEP 3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLv6RYMjMqqDRupFf:jOTcK+NrRioGHlz8rz0i/kzQqqDgpFf
MD5 SHA1 SHA512 SSDEEP

windows x86

NetWire RAT payload

rat

Minor OS version

Major OS version

Entry point

9261

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

129KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

49B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

85f2132d070df7e82193663b26d0bc0bc0a1b3d0d7f799beadf22ca845f771df