Overview

overview

10

Static

static

3d6bc146d5...5b.exe

windows7_x64

10

3d6bc146d5...5b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3d6bc146d5338159005ae3d66c7fda67a6ada1dc1a66b4ab17301ef4ec1b665b

  • Size

    448KB

  • Sample

    220703-dnphxadaek

  • MD5

    44a765fe57dea1ae7b642010c7209932

  • SHA1

    3e97fc2183c9af4d8f71d0a546b6c2611495a46c

  • SHA256

    3d6bc146d5338159005ae3d66c7fda67a6ada1dc1a66b4ab17301ef4ec1b665b

  • SHA512

    6ecba354b1cd685588cf7aa44092d99e227a7e99bfd1c9b8811960a556e556b555853560271b1cc4f8744dbbd95c726b6ce183ae9fdd298efaf7bcd551d1edae

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

popen.ru:6970

dhfgh.online:6970

popen43.ru:6970
Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    SC Native

  • lock_executable

    false

  • mutex

    OjxxiSpn

  • offline_keylogger

    false

  • password

    ppF7"oRyqm

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      3d6bc146d5338159005ae3d66c7fda67a6ada1dc1a66b4ab17301ef4ec1b665b

    • Size

      448KB

    • MD5

      44a765fe57dea1ae7b642010c7209932

    • SHA1

      3e97fc2183c9af4d8f71d0a546b6c2611495a46c

    • SHA256

      3d6bc146d5338159005ae3d66c7fda67a6ada1dc1a66b4ab17301ef4ec1b665b

    • SHA512

      6ecba354b1cd685588cf7aa44092d99e227a7e99bfd1c9b8811960a556e556b555853560271b1cc4f8744dbbd95c726b6ce183ae9fdd298efaf7bcd551d1edae

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks