Overview

overview

10

Static

static

9173f2faec...ae.exe

windows7_x64

10

9173f2faec...ae.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9173f2faece11779acf4f2a7e484e7c497ea5173ca88376db256515889cae3ae

  • Size

    652KB

  • Sample

    220520-fw4nxabda7

  • MD5

    420950c1614843f3c0bc07eb6eceb8f1

  • SHA1

    65191175015468751ad235784f44942ba585e865

  • SHA256

    9173f2faece11779acf4f2a7e484e7c497ea5173ca88376db256515889cae3ae

  • SHA512

    bd676c38e78fa9c5fa7af97577904337b1c9cea033a1515ea6b22e1ed351d03565ab5006a56b5c2e1231e56fa1e91a7eff8d35d2414b41a29128bcc5e9c14588

Score
10/10
netwirebotnetratstealer

Malware Config

Targets

    • Target

      9173f2faece11779acf4f2a7e484e7c497ea5173ca88376db256515889cae3ae

    • Size

      652KB

    • MD5

      420950c1614843f3c0bc07eb6eceb8f1

    • SHA1

      65191175015468751ad235784f44942ba585e865

    • SHA256

      9173f2faece11779acf4f2a7e484e7c497ea5173ca88376db256515889cae3ae

    • SHA512

      bd676c38e78fa9c5fa7af97577904337b1c9cea033a1515ea6b22e1ed351d03565ab5006a56b5c2e1231e56fa1e91a7eff8d35d2414b41a29128bcc5e9c14588

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks