Overview

overview

10

Static

static

521f60d831...fe.exe

windows7-x64

10

521f60d831...fe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe

  • Size

    468KB

  • Sample

    220717-ek5w6agaek

  • MD5

    aba4534e0a32d9b6158514fd6829c29c

  • SHA1

    855c1a2c25a270715ca58a8b2319c4538402adf5

  • SHA256

    521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe

  • SHA512

    ec038de9de260adff7e5d642c58598951425b0a88605da78eaf111a13a20ca9c5316d7a2b15959e92c257075c06237c6ccd3228f17395f4e80ebcb5474167458

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

77.48.28.246:8912

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe

    • Size

      468KB

    • MD5

      aba4534e0a32d9b6158514fd6829c29c

    • SHA1

      855c1a2c25a270715ca58a8b2319c4538402adf5

    • SHA256

      521f60d83117e098a1864782e1839b8220d36a444210ad9bc8ab13e2be4827fe

    • SHA512

      ec038de9de260adff7e5d642c58598951425b0a88605da78eaf111a13a20ca9c5316d7a2b15959e92c257075c06237c6ccd3228f17395f4e80ebcb5474167458

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks