Overview

overview

10

Static

static

21dcf18b39...3f.exe

windows7-x64

10

21dcf18b39...3f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    21dcf18b3949a5a3adfa4be19dd4c177f9ad087bf8e19895c146a076b337a73f

  • Size

    738KB

  • Sample

    220725-c5zjrsbefm

  • MD5

    4a95e7a9d4b8c642838e304b1f567bce

  • SHA1

    0179ac1ce47a0d5038aa14748a85ad26373fa142

  • SHA256

    21dcf18b3949a5a3adfa4be19dd4c177f9ad087bf8e19895c146a076b337a73f

  • SHA512

    9b4121849d81407973300c80e4c725d03071b9b93feca7fd7bcb7aef0cd35d80dc7cf747d544a76db764745b31ac889b896987bbe3849a57e1860fa0a7e91729

Score
10/10
netwirebotnetratstealer

Malware Config

Targets

    • Target

      21dcf18b3949a5a3adfa4be19dd4c177f9ad087bf8e19895c146a076b337a73f

    • Size

      738KB

    • MD5

      4a95e7a9d4b8c642838e304b1f567bce

    • SHA1

      0179ac1ce47a0d5038aa14748a85ad26373fa142

    • SHA256

      21dcf18b3949a5a3adfa4be19dd4c177f9ad087bf8e19895c146a076b337a73f

    • SHA512

      9b4121849d81407973300c80e4c725d03071b9b93feca7fd7bcb7aef0cd35d80dc7cf747d544a76db764745b31ac889b896987bbe3849a57e1860fa0a7e91729

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks