Overview

overview

10

Static

static

5

3f43b3ee4e...dc.exe

windows7_x64

10

3f43b3ee4e...dc.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc

  • Size

    1.2MB

  • Sample

    220701-ewn3sabfhq

  • MD5

    c9a5eb3649bee27da9e4705bd49b3bb2

  • SHA1

    19e28e7493f6cd69040c83df97a99c7ab94fa3e6

  • SHA256

    3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc

  • SHA512

    719105b5b60bfea751e59e88194708e16c0ca7c1615ccfa93d30c9a49d3a61bbe5096efff6ded4ce38cac0a21856e6f4542e30d2cc0a8ce1e6a220d3ac3eec37

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

79.134.225.73:1968

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    pd1n9

  • lock_executable

    false

  • mutex

    KHAtGUwc

  • offline_keylogger

    false

  • password

    Kimbolsapoq!P13

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc

    • Size

      1.2MB

    • MD5

      c9a5eb3649bee27da9e4705bd49b3bb2

    • SHA1

      19e28e7493f6cd69040c83df97a99c7ab94fa3e6

    • SHA256

      3f43b3ee4e27207c48a8ba86dfbbc18db28747621775d5337f21b528cbca42dc

    • SHA512

      719105b5b60bfea751e59e88194708e16c0ca7c1615ccfa93d30c9a49d3a61bbe5096efff6ded4ce38cac0a21856e6f4542e30d2cc0a8ce1e6a220d3ac3eec37

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks