Overview

overview

10

Static

static

9cab0f6151...28.exe

windows7-x64

10

9cab0f6151...28.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328

  • Size

    1.1MB

  • Sample

    220725-agy7zsehdk

  • MD5

    061dc947f87b44a8e531a4c6038ce9d6

  • SHA1

    0892589b478df6ffba31e3d021e2b8c55dd81651

  • SHA256

    9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328

  • SHA512

    1bd471f606bdabf0b3f4af1aca75a22c565cf4043b410433643f7d4a6665af870159beb23428f148a4b27d2c5761f5d415ce533f2af96081d9147196f3314a2b

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328

    • Size

      1.1MB

    • MD5

      061dc947f87b44a8e531a4c6038ce9d6

    • SHA1

      0892589b478df6ffba31e3d021e2b8c55dd81651

    • SHA256

      9cab0f61512b3ae9466db036a7a3dfc6b6deaa3756f9ba72fa7095a0c8f82328

    • SHA512

      1bd471f606bdabf0b3f4af1aca75a22c565cf4043b410433643f7d4a6665af870159beb23428f148a4b27d2c5761f5d415ce533f2af96081d9147196f3314a2b

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks