netwire | 63dd3d80cb6a0e972026926eb2efe842b1ac1789ca708a3e2de6131266bdfc84

Sharing

Copy URL Twitter E-mail

General

Target
63dd3d80cb6a0e972026926eb2efe842b1ac1789ca708a3e2de6131266bdfc84
Size 120KB
Sample220217-csfwwsfhe7
SHA256 63dd3d80cb6a0e972026926eb2efe842b1ac1789ca708a3e2de6131266bdfc84
MD5 57be44ad0371f11d6956faf79732438b
SHA1 2eff749c1d732bad2163c25d6091907b5f58d54d
SHA512 3bb59a7c43e743eb1c7e0a8e4c299e0bfbb3aab286a5a77f3364451dfaf015dc87c5dcc8e79929c0c53d81ae51aaac81c7bcbaa593389782538fc09d8c55ae00
SSDEEP 1536:CLp3YvQCGQ10ismSklVI8VjCX1Isv3fA9qeRgLHsbgjSr1cgS4iE+Z:CLp3Yvhn9VI8VjCX1I43fAwegLMZrkD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat netwire

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
sample	netwire

Netwire family
netwire

File Explorer

63dd3d80cb6a0e972026926eb2efe842b1ac1789ca708a3e2de6131266bdfc84

.exe 120KB

63dd3d80cb6a0e972026926eb2efe842b1ac1789ca708a3e2de6131266bdfc84

IMPHASH eaf9915d2b5730c3717ea003bd93404a
SHA256 63dd3d80cb6a0e972026926eb2efe842b1ac1789ca708a3e2de6131266bdfc84
MD5 57be44ad0371f11d6956faf79732438b
SHA1 2eff749c1d732bad2163c25d6091907b5f58d54d
SHA512 3bb59a7c43e743eb1c7e0a8e4c299e0bfbb3aab286a5a77f3364451dfaf015dc87c5dcc8e79929c0c53d81ae51aaac81c7bcbaa593389782538fc09d8c55ae00
SSDEEP 1536:CLp3YvQCGQ10ismSklVI8VjCX1Isv3fA9qeRgLHsbgjSr1cgS4iE+Z:CLp3Yvhn9VI8VjCX1I43fAwegLMZrkD
MD5 SHA1 SHA512 SSDEEP

windows x86

NetWire RAT payload

rat

Minor OS version

Major OS version

Entry point

8666

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetUserNameA RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

crypt32

CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

kernel32

CloseHandle CreateDirectoryA CreateFileA CreateMutexA CreatePipe CreateProcessA CreateToolhelp32Snapshot DeleteFileA EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetComputerNameA GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExA GetDriveTypeA GetFileAttributesA GetFileAttributesExA GetLastError GetLocalTime GetLogicalDriveStringsA GetModuleFileNameA GetProcAddress GetProcessTimes GetStartupInfoA GetSystemInfo GetSystemTime GetTickCount GetVersionExA GetVolumeInformationA InitializeCriticalSection LeaveCriticalSection LoadLibraryA LocalFree MoveFileA OpenProcess PeekNamedPipe Process32First Process32Next ReadFile ReleaseMutex ResumeThread SetErrorMode SetFileAttributesA SetFilePointer Sleep TerminateProcess WideCharToMultiByte WriteFile

msvcrt

_beginthreadex _filelengthi64 _vscprintf _vsnprintf fclose fflush fgetpos fgets fopen fread free fsetpos fwrite getenv malloc realloc strlen

shell32

SHGetPathFromIDListA SHGetSpecialFolderLocation

user32

CreateWindowExA DefWindowProcA DispatchMessageA EnumWindows GetDC GetDesktopWindow GetForegroundWindow GetKeyNameTextA GetKeyState GetKeyboardState GetMessageA GetSystemMetrics GetWindowTextA IsWindowVisible MapVirtualKeyA PostQuitMessage RegisterClassExA ReleaseDC SendMessageA SetCursorPos SetWindowTextA ShowWindow ToAscii TranslateMessage keybd_event mouse_event

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSAStartup __WSAFDIsSet closesocket connect gethostbyname gethostname htons inet_ntoa ioctlsocket ntohs recv select send setsockopt shutdown socket