netwire | 5e6687f501471c70084198cdb2ea26a8066d252b1a52088d25fa6db4a0f8b586

Sharing

Copy URL Twitter E-mail

General

Target
5e6687f501471c70084198cdb2ea26a8066d252b1a52088d25fa6db4a0f8b586
Size 98KB
Sample220217-ddaxrsgca8
SHA256 5e6687f501471c70084198cdb2ea26a8066d252b1a52088d25fa6db4a0f8b586
MD5 5e84f4404713fdd127233791249d52a0
SHA1 31e15bd6ea7d10cf9f7e4630573ff46a922b09f4
SHA512 13ee9088e2de20ff59c2db1b484a66eabd48facbddca820369f0013db9ce191efbf7f073ac1c37eec3a96a379603699fcb7da4539b7291aceecd76695d9a7ca2
SSDEEP 1536:7Lp3YvQCGQ10ismSklVI8VjCX1Isv3fA9qeRgLHsbgfSr1b/:7Lp3Yvhn9VI8VjCX1I43fAwegLMRrF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat netwire

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
sample	netwire

Netwire family
netwire

File Explorer

5e6687f501471c70084198cdb2ea26a8066d252b1a52088d25fa6db4a0f8b586

.exe 98KB

5e6687f501471c70084198cdb2ea26a8066d252b1a52088d25fa6db4a0f8b586

IMPHASH eaf9915d2b5730c3717ea003bd93404a
SHA256 5e6687f501471c70084198cdb2ea26a8066d252b1a52088d25fa6db4a0f8b586
MD5 5e84f4404713fdd127233791249d52a0
SHA1 31e15bd6ea7d10cf9f7e4630573ff46a922b09f4
SHA512 13ee9088e2de20ff59c2db1b484a66eabd48facbddca820369f0013db9ce191efbf7f073ac1c37eec3a96a379603699fcb7da4539b7291aceecd76695d9a7ca2
SSDEEP 1536:7Lp3YvQCGQ10ismSklVI8VjCX1Isv3fA9qeRgLHsbgfSr1b/:7Lp3Yvhn9VI8VjCX1I43fAwegLMRrF
MD5 SHA1 SHA512 SSDEEP

windows x86

NetWire RAT payload

rat

Minor OS version

Major OS version

Entry point

8666

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetUserNameA RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

crypt32

CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

kernel32

CloseHandle CreateDirectoryA CreateFileA CreateMutexA CreatePipe CreateProcessA CreateToolhelp32Snapshot DeleteFileA EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetComputerNameA GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExA GetDriveTypeA GetFileAttributesA GetFileAttributesExA GetLastError GetLocalTime GetLogicalDriveStringsA GetModuleFileNameA GetProcAddress GetProcessTimes GetStartupInfoA GetSystemInfo GetSystemTime GetTickCount GetVersionExA GetVolumeInformationA InitializeCriticalSection LeaveCriticalSection LoadLibraryA LocalFree MoveFileA OpenProcess PeekNamedPipe Process32First Process32Next ReadFile ReleaseMutex ResumeThread SetErrorMode SetFileAttributesA SetFilePointer Sleep TerminateProcess WideCharToMultiByte WriteFile

msvcrt

_beginthreadex _filelengthi64 _vscprintf _vsnprintf fclose fflush fgetpos fgets fopen fread free fsetpos fwrite getenv malloc realloc strlen

shell32

SHGetPathFromIDListA SHGetSpecialFolderLocation

user32

CreateWindowExA DefWindowProcA DispatchMessageA EnumWindows GetDC GetDesktopWindow GetForegroundWindow GetKeyNameTextA GetKeyState GetKeyboardState GetMessageA GetSystemMetrics GetWindowTextA IsWindowVisible MapVirtualKeyA PostQuitMessage RegisterClassExA ReleaseDC SendMessageA SetCursorPos SetWindowTextA ShowWindow ToAscii TranslateMessage keybd_event mouse_event

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSAStartup __WSAFDIsSet closesocket connect gethostbyname gethostname htons inet_ntoa ioctlsocket ntohs recv select send setsockopt shutdown socket