Overview

overview

10

Static

static

5

4d90dc3871...06.exe

windows7_x64

10

4d90dc3871...06.exe

windows10-2004_x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4d90dc38718256408ca49d411ac8e18730b22ce871f458c2acafeb3525fff106

  • Size

    935KB

  • Sample

    220712-c2cktsfdar

  • MD5

    8a8730a80f703191573763ef36cfa582

  • SHA1

    14a03c871c60459343c6be5d160af9482dc64990

  • SHA256

    4d90dc38718256408ca49d411ac8e18730b22ce871f458c2acafeb3525fff106

  • SHA512

    ba59c1a7c9c519996e62c92cc70a1371569c81bd29c7e45c271fd58d5592a08ff42a47ed759de066b86b8095c5c45f1227b2d11509e51a003385371274d439a1

Score
10/10
netwirebotnetratstealer

Malware Config

Targets

    • Target

      4d90dc38718256408ca49d411ac8e18730b22ce871f458c2acafeb3525fff106

    • Size

      935KB

    • MD5

      8a8730a80f703191573763ef36cfa582

    • SHA1

      14a03c871c60459343c6be5d160af9482dc64990

    • SHA256

      4d90dc38718256408ca49d411ac8e18730b22ce871f458c2acafeb3525fff106

    • SHA512

      ba59c1a7c9c519996e62c92cc70a1371569c81bd29c7e45c271fd58d5592a08ff42a47ed759de066b86b8095c5c45f1227b2d11509e51a003385371274d439a1

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Loads dropped DLL

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks