Extracted

• • Target

    Confidential.exe

  • Size

    727KB

  • MD5

    77d64026e7224a2243bcb023766111e6

  • SHA1

    0124b3fc954340b6857c96b37e89e9eca64da43a

  • SHA256

    b002c64f7d0ff0a952b72f31609e683f17bb23313417f6639afdec47d9187b25

  • SHA512

    aa233f2db25af667574de2de6870cd6aa259b62700f604bf0478dac442a358a143853c8b8ad0c913f91b3b3e05662a3c9a7216cd1ca051fd0c20e5fbba40a0b8

  • SSDEEP

    12288:voxpAdRDmK6S8IB++Ll22jqZEp5E3qjJ5nl0+9MK:Z56SRB++LVMy1jrZe

  Score

  10^/10

  netwirebotnetevasionratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2