netwire | c2268bf31831425cafcea2863195457979514c2213bda36f8e0a17f411f99ca9 | Triage

Sharing

General

Target

c2268bf31831425cafcea2863195457979514c2213bda36f8e0a17f411f99ca9
Size

606KB
MD5

8ecf0b8f8a455125d1aa583acc4e9ad3
SHA1

33706f04cead4adfd94118fed35f23b79752b434
SHA256

c2268bf31831425cafcea2863195457979514c2213bda36f8e0a17f411f99ca9
SHA512

572e5b22d97ffcbc4884743100793eb4b4507cf1a8a162818e9773b996b2326531a3193bf22311724e0ccd40dbc633407cf241748b75f954872adfd84ae6a8a1
SSDEEP

12288:vqN0omBJfFDbH9cY+Ms9RzhZz8egiO9WX2YIF:ULmB9dqYWRzhZz2vWmYIF

Score

10^/10

rat netwire

Malware Config

Signatures

NetWire RAT payload 1 IoCs
rat

Processes:

resource yara_rule

sample netwire
Netwire family
netwire

Files

c2268bf31831425cafcea2863195457979514c2213bda36f8e0a17f411f99ca9
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 352KB - Virtual size: 352KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ