Overview

overview

10

Static

static

596c61c9c3...2b.exe

windows7-x64

10

596c61c9c3...2b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    596c61c9c3a7a0ba5419dab7a5ef731310560bbd8720fc8d157deb6c1b77762b

  • Size

    484KB

  • Sample

    220724-ekh3dseeap

  • MD5

    9ceb56c944daaac4d44ec26684512979

  • SHA1

    7df0bcc528c506ad4cde9bde3cfdce0e9dc471e7

  • SHA256

    596c61c9c3a7a0ba5419dab7a5ef731310560bbd8720fc8d157deb6c1b77762b

  • SHA512

    a7ddfbf68b943662fc74b700d1ce18b5449081a7e77d32c549cbeee565b2c12402ae5340b1ec06b4b314650b84b3d0b9156a44816af281851f9880b351ae54c3

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

185.208.211.136:3368

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    UIOnYWdp

  • offline_keylogger

    true

  • password

    Gentle123

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      596c61c9c3a7a0ba5419dab7a5ef731310560bbd8720fc8d157deb6c1b77762b

    • Size

      484KB

    • MD5

      9ceb56c944daaac4d44ec26684512979

    • SHA1

      7df0bcc528c506ad4cde9bde3cfdce0e9dc471e7

    • SHA256

      596c61c9c3a7a0ba5419dab7a5ef731310560bbd8720fc8d157deb6c1b77762b

    • SHA512

      a7ddfbf68b943662fc74b700d1ce18b5449081a7e77d32c549cbeee565b2c12402ae5340b1ec06b4b314650b84b3d0b9156a44816af281851f9880b351ae54c3

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks