Overview

overview

10

Static

static

5

3c8a489d9e...5a.exe

windows7_x64

10

3c8a489d9e...5a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3c8a489d9eccfa423ae7428eda6b50643485ce5a0a82e337dd7d55141b91165a

  • Size

    1.1MB

  • Sample

    220703-hyfe7sbhe9

  • MD5

    98d3c0dde3018455aeac6aca14acafea

  • SHA1

    0060ca9137a052d2e954b0d62112bb8b72e0ba94

  • SHA256

    3c8a489d9eccfa423ae7428eda6b50643485ce5a0a82e337dd7d55141b91165a

  • SHA512

    6b8da7f8f591d937f7288e42d86c2bdb6c7d83fc0f89c48d5a675578d1fe90f0416b73bea1df76492bdc4085f91a593d577077ecb9b6fc135bee6ac390834fb6

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

185.208.211.218:8090

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      3c8a489d9eccfa423ae7428eda6b50643485ce5a0a82e337dd7d55141b91165a

    • Size

      1.1MB

    • MD5

      98d3c0dde3018455aeac6aca14acafea

    • SHA1

      0060ca9137a052d2e954b0d62112bb8b72e0ba94

    • SHA256

      3c8a489d9eccfa423ae7428eda6b50643485ce5a0a82e337dd7d55141b91165a

    • SHA512

      6b8da7f8f591d937f7288e42d86c2bdb6c7d83fc0f89c48d5a675578d1fe90f0416b73bea1df76492bdc4085f91a593d577077ecb9b6fc135bee6ac390834fb6

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks