Overview

overview

10

Static

static

5

58da1d8aff...89.exe

windows7-x64

10

58da1d8aff...89.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389

  • Size

    1.0MB

  • Sample

    220724-g3nfyaadc2

  • MD5

    8626dbe675f9388d54ccaf173ec55fbc

  • SHA1

    331ca65cd4ba779d767b87385cabfbe78fb8398d

  • SHA256

    58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389

  • SHA512

    baab118459e39af468596e38090b46e57fe65cc2c3fc3fbd2d1f25d17f610e4f956a9f5c2bfbec39f3047169f4e05c797f6b93a590670ebfa903d6ae2d9e40f1

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

freststatzz.ddns.net:3361

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    15

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    wtxAwUGY

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389

    • Size

      1.0MB

    • MD5

      8626dbe675f9388d54ccaf173ec55fbc

    • SHA1

      331ca65cd4ba779d767b87385cabfbe78fb8398d

    • SHA256

      58da1d8aff78b604e7b287da85ed58002f81d2be6d6b4631d2aae079cab98389

    • SHA512

      baab118459e39af468596e38090b46e57fe65cc2c3fc3fbd2d1f25d17f610e4f956a9f5c2bfbec39f3047169f4e05c797f6b93a590670ebfa903d6ae2d9e40f1

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks