Extracted

Extracted

• • Target

    Invoice2.xll

  • Size

    1.8MB

  • MD5

    404a960e1f8906c4be238963f40ac58d

  • SHA1

    71793267556d9a66f3c324a94cb14593cbde5e55

  • SHA256

    a36e885bc0c8a691dda06f59183df0c1d9aa95d5b3be78e7f15e06112df91dd3

  • SHA512

    b3d28093046166806c37034dbcf129a0353645bc257891146b541fd522baf79f8a0b4376dd5bd5151d2f49ecd99b997c0ede0f15550dda147174187fe5ff11a4

  Score

  10^/10

  netwirebotnetratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2