Overview

overview

10

Static

static

Payment_PDF.js

windows7-x64

10

Payment_PDF.js

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payment_PDF.js

  • Size

    414KB

  • Sample

    220817-qy4f2agccn

  • MD5

    c2bd31714a000c20d168677d564de7ba

  • SHA1

    7132987c2122cca918aaaed04e916cd89937e857

  • SHA256

    491873933a34096211944daa1528b663785bf48e68c98586cbc69dbb063df0a5

  • SHA512

    cff94fcc9f6339a77eb206c9329157b91170fa35ff94a26abe1b99b64a1c6208d2c80852c520e388f069ed94907acea60e8c24f3459ca024764e56c1d4afb776

  • SSDEEP

    6144:U8Kay7RHK2uA83l6A7VdJNylVLsVnwtooHF1Rr9Dx2k8gxBStAorf:ULJ3A7VdzyH4VnQHFDrlawG

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      Payment_PDF.js

    • Size

      414KB

    • MD5

      c2bd31714a000c20d168677d564de7ba

    • SHA1

      7132987c2122cca918aaaed04e916cd89937e857

    • SHA256

      491873933a34096211944daa1528b663785bf48e68c98586cbc69dbb063df0a5

    • SHA512

      cff94fcc9f6339a77eb206c9329157b91170fa35ff94a26abe1b99b64a1c6208d2c80852c520e388f069ed94907acea60e8c24f3459ca024764e56c1d4afb776

    • SSDEEP

      6144:U8Kay7RHK2uA83l6A7VdJNylVLsVnwtooHF1Rr9Dx2k8gxBStAorf:ULJ3A7VdzyH4VnQHFDrlawG

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks