Extracted

• • Target

    SecuriteInfo.com.W32.AIDetectNet.01.15534.12656

  • Size

    713KB

  • MD5

    aebb05f6834535c412ba7ccea11c5eec

  • SHA1

    306b3aca470ccb23f88c18999da1d4b53346a79d

  • SHA256

    279f8bd4621f977e47756985c0cbf14e03c7f15c5200e83f03517a73649aa893

  • SHA512

    91b24bf1647211c507c0c69c5b4058cf5785cc58327e7cb1789ef772eeb832cdfed70b9f43d957597be04795cb995b77a07528176564f5800bc3cde245c0ca12

  • SSDEEP

    12288:EAGfi8JQfIT/0e5hz9bUVXhu8gqmU5qZ4Fb4eRO/zqA8RrBncXnPy:ofi8SfIT/0shbM4J4qMtRaeA8tB8Py

  Score

  10^/10

  netwirebotnetratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2