Overview

overview

10

Static

static

Order #165...0X.exe

windows7-x64

1

Order #165...0X.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order #165-3520P-WTMM10X.exe

  • Size

    261KB

  • Sample

    220812-s5ateaeheq

  • MD5

    2bf6d8556ca6620a7f3802521da5c138

  • SHA1

    68ad243311f33ed4cfb4b3d75c9e3f0a271be58f

  • SHA256

    39b9b9d2c699f8523e55a05bfc74f6f5764fabb0a1418f1cec4bc78609c1b37b

  • SHA512

    9c8e092b7f786d3a768794da9ad28c257f8b78008ffa598c76f8e6ecfcc4a6af06b60a50f3faafcbf39833e0f9d5ac96d5301bc1a7ad1f9633a0378452281dcd

Score
10/10
netwirebotnetratstealer

Malware Config

Targets

    • Target

      Order #165-3520P-WTMM10X.exe

    • Size

      261KB

    • MD5

      2bf6d8556ca6620a7f3802521da5c138

    • SHA1

      68ad243311f33ed4cfb4b3d75c9e3f0a271be58f

    • SHA256

      39b9b9d2c699f8523e55a05bfc74f6f5764fabb0a1418f1cec4bc78609c1b37b

    • SHA512

      9c8e092b7f786d3a768794da9ad28c257f8b78008ffa598c76f8e6ecfcc4a6af06b60a50f3faafcbf39833e0f9d5ac96d5301bc1a7ad1f9633a0378452281dcd

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Downloads MZ/PE file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks