netwire | 81068095a25365160b7228801531362e9dbb7bc11a26d27e0126c9667efabfb4

Sharing

Copy URL Twitter E-mail

General

Target
81068095a25365160b7228801531362e9dbb7bc11a26d27e0126c9667efabfb4
Size 110KB
Sample220217-af2aysgaam
SHA256 81068095a25365160b7228801531362e9dbb7bc11a26d27e0126c9667efabfb4
MD5 d25f3713c231dc8439fc0bc545a11715
SHA1 a676388d3119b51e1b3e373a9955688d1369847a
SHA512 3fe19406f3638bb8cb916c0b997f1757ac9c602cb98db77e1abae4d4e47e9729cdbf4babba0ab3bf75b03c3e7794d2104e9978492b2ba6a4fc8bc471d13ab5f6
SSDEEP 1536:kSO5/UUVlyQ0tD5pkoCVOeV7Dbu8VdFZqMtRzMlyyLtDGqBX2+4MeZGugS4iEK9:7O5/z70lCVOeV7Dbu6dFEoGPtjN26oH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat netwire

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
sample	netwire

Netwire family
netwire

File Explorer

81068095a25365160b7228801531362e9dbb7bc11a26d27e0126c9667efabfb4

.exe 110KB

81068095a25365160b7228801531362e9dbb7bc11a26d27e0126c9667efabfb4

IMPHASH 5882229ac96113c9b1a95985659650cf
SHA256 81068095a25365160b7228801531362e9dbb7bc11a26d27e0126c9667efabfb4
MD5 d25f3713c231dc8439fc0bc545a11715
SHA1 a676388d3119b51e1b3e373a9955688d1369847a
SHA512 3fe19406f3638bb8cb916c0b997f1757ac9c602cb98db77e1abae4d4e47e9729cdbf4babba0ab3bf75b03c3e7794d2104e9978492b2ba6a4fc8bc471d13ab5f6
SSDEEP 1536:kSO5/UUVlyQ0tD5pkoCVOeV7Dbu8VdFZqMtRzMlyyLtDGqBX2+4MeZGugS4iEK9:7O5/z70lCVOeV7Dbu6dFEoGPtjN26oH
MD5 SHA1 SHA512 SSDEEP

windows x86

NetWire RAT payload

rat

Minor OS version

Major OS version

Entry point

8666

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetUserNameA RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

crypt32

CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

kernel32

CloseHandle CreateDirectoryA CreateFileA CreateMutexA CreatePipe CreateProcessA CreateToolhelp32Snapshot DeleteFileA EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetComputerNameA GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExA GetDriveTypeA GetFileAttributesA GetFileAttributesExA GetLastError GetLocalTime GetLogicalDriveStringsA GetModuleFileNameA GetProcAddress GetProcessTimes GetStartupInfoA GetSystemInfo GetSystemTime GetTickCount GetTimeZoneInformation GetVersionExA GetVolumeInformationA InitializeCriticalSection LeaveCriticalSection LoadLibraryA LocalFree MoveFileA OpenProcess PeekNamedPipe Process32First Process32Next ReadFile ReleaseMutex ResumeThread SetErrorMode SetFileAttributesA SetFilePointer Sleep TerminateProcess WideCharToMultiByte WriteFile

msvcrt

_beginthreadex _filelengthi64 _vscprintf _vsnprintf fclose fflush fgetpos fgets fopen fread free fsetpos fwrite getenv malloc printf realloc strlen

shell32

SHGetPathFromIDListA SHGetSpecialFolderLocation

user32

CreateWindowExA DefWindowProcA DispatchMessageA EnumWindows GetDC GetDesktopWindow GetForegroundWindow GetKeyNameTextA GetKeyState GetKeyboardState GetMessageA GetSystemMetrics GetWindowTextA IsWindowVisible MapVirtualKeyA MessageBoxA PostQuitMessage RegisterClassExA ReleaseDC SendMessageA SetCursorPos SetWindowTextA ShowWindow ToAscii TranslateMessage keybd_event mouse_event

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSAStartup __WSAFDIsSet closesocket connect gethostbyname gethostname htons inet_ntoa ioctlsocket ntohs recv select send setsockopt shutdown socket