Overview

overview

10

Static

static

5

49593d50b9...2a.exe

windows7_x64

7

49593d50b9...2a.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    49593d50b98d8ab429704387e7a1663c5aa53aed6c007c17e960a7a3d435e72a

  • Size

    1.2MB

  • Sample

    220714-acpgzschfr

  • MD5

    87c6e46715878db1236b4d02ed40b1b2

  • SHA1

    3554b9a38df7f61ece5292a6dd7ba1d13733f2ad

  • SHA256

    49593d50b98d8ab429704387e7a1663c5aa53aed6c007c17e960a7a3d435e72a

  • SHA512

    6c6d43dadd24f251385efb04e10e4be390c6bbed6e9168e052b2e2afe0644482117b514f1d1e940ccc99141ad59bb9104d10352ce1b7cdbf841cdb5346742a69

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

79.134.225.73:1968

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    pd1n9

  • lock_executable

    false

  • mutex

    KHAtGUwc

  • offline_keylogger

    false

  • password

    Kimbolsapoq!P13

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      49593d50b98d8ab429704387e7a1663c5aa53aed6c007c17e960a7a3d435e72a

    • Size

      1.2MB

    • MD5

      87c6e46715878db1236b4d02ed40b1b2

    • SHA1

      3554b9a38df7f61ece5292a6dd7ba1d13733f2ad

    • SHA256

      49593d50b98d8ab429704387e7a1663c5aa53aed6c007c17e960a7a3d435e72a

    • SHA512

      6c6d43dadd24f251385efb04e10e4be390c6bbed6e9168e052b2e2afe0644482117b514f1d1e940ccc99141ad59bb9104d10352ce1b7cdbf841cdb5346742a69

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks