Extracted

• • Target

    a7dd00a0ddfc3d57986dabe9535955b40719dd059a0b272ca51b3897077d8829

  • Size

    381KB

  • MD5

    be0d491ab953acdbfde79e8bd3280fe0

  • SHA1

    f6bc578f40013c645682284aad3cd144f4dd10a1

  • SHA256

    a7dd00a0ddfc3d57986dabe9535955b40719dd059a0b272ca51b3897077d8829

  • SHA512

    65ef83c37bb2c5680f4cee48f831254e773f6a1c05a50bae95aa7d53fa905a207596c916473b40ee4a735f3a446be8718a677c98f0ddfbe3080e42358655d414

  Score

  10^/10

  netwirebotnetevasionratstealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Executes dropped EXE

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Uses the VBS compiler for execution

  • Windows security modification

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2