Extracted

• • Target

    81dbe903ee1e3ebe0d3e5edc9f4072996b44e2c6557f1af309d25a147029d7dd

  • Size

    571KB

  • MD5

    c4e5cf65384d74ccae53b3703200a43f

  • SHA1

    007cc54e2e4d6a424594750e0efca1d1a916b35c

  • SHA256

    81dbe903ee1e3ebe0d3e5edc9f4072996b44e2c6557f1af309d25a147029d7dd

  • SHA512

    7c22fdf9fa9ee2a252e347a56256d2f7f5aea96bc37cb954142a9cbb6a4fbc6ac6b5ff9f2d5b01342627efbde9bf64d628f148b94e33d8b37c5809bbe8b7a7dc

  Score

  10^/10

  netwirebotnetpersistenceratstealerupx

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Executes dropped EXE

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2