Overview

overview

10

Static

static

Receipt.exe

windows7-x64

10

Receipt.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Receipt.exe

  • Size

    1.1MB

  • Sample

    220719-n456pscgdm

  • MD5

    92220ac479344c60ae11a3d8c74a2b36

  • SHA1

    c8170dcc4766b603e6cad4d854f9ec3b7c4dcce2

  • SHA256

    e1a77fa5285413469295dae451a81e68613360acbd05c127701e6e289279acfd

  • SHA512

    cc1b11100fcb419a94b33215cad1949778e9e694977c09d77e384269ef9a012aba7d107cd00acd84c0a5114773b1a3c8e11e262e779e78624fcda318eb29c43f

Score
10/10
netwirebotnetevasionratstealer

Malware Config

Extracted

Family

netwire

C2

185.140.53.61:3363

185.140.53.61:3365
Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    move4ward

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      Receipt.exe

    • Size

      1.1MB

    • MD5

      92220ac479344c60ae11a3d8c74a2b36

    • SHA1

      c8170dcc4766b603e6cad4d854f9ec3b7c4dcce2

    • SHA256

      e1a77fa5285413469295dae451a81e68613360acbd05c127701e6e289279acfd

    • SHA512

      cc1b11100fcb419a94b33215cad1949778e9e694977c09d77e384269ef9a012aba7d107cd00acd84c0a5114773b1a3c8e11e262e779e78624fcda318eb29c43f

    Score
    10/10
    netwirebotnetevasionratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks