Overview

overview

10

Static

static

cfe50307ac...ab.exe

windows7-x64

10

cfe50307ac...ab.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cfe50307ac8ba1860504b4bdea4bc47c67c1873539f786b8453e6e8b7cabe5ab

  • Size

    608KB

  • Sample

    220724-vjwj4abhcj

  • MD5

    278e9e7d40d9950b34bb09fa726a4599

  • SHA1

    c5ced3269ec258612738ccb2fc1c73ae60873c68

  • SHA256

    cfe50307ac8ba1860504b4bdea4bc47c67c1873539f786b8453e6e8b7cabe5ab

  • SHA512

    cfeecfa90ee26c4c21f384eaa195f4f9d2ba6d2fda853b154c5de86802232b8b04b75e1e9dd20c7724ec5e7f8a891a2284eeff8c5d3559b78a7f62ef322a89b1

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      cfe50307ac8ba1860504b4bdea4bc47c67c1873539f786b8453e6e8b7cabe5ab

    • Size

      608KB

    • MD5

      278e9e7d40d9950b34bb09fa726a4599

    • SHA1

      c5ced3269ec258612738ccb2fc1c73ae60873c68

    • SHA256

      cfe50307ac8ba1860504b4bdea4bc47c67c1873539f786b8453e6e8b7cabe5ab

    • SHA512

      cfeecfa90ee26c4c21f384eaa195f4f9d2ba6d2fda853b154c5de86802232b8b04b75e1e9dd20c7724ec5e7f8a891a2284eeff8c5d3559b78a7f62ef322a89b1

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks