netwire

General

Target

2b1245c4547eee5a4545431f1969ab4dd5ba8ac4d0d2dd758d3c77a250e6ddb8.zip
Size

1.1MB
Sample

221023-v74klsbec6
MD5

4ea1869e9fa0e523bf0df8cf13d4c6c1
SHA1

75b82d430f4424e146125286edb0d730e358b283
SHA256

52f9d316545f41cf9c29abdeedf5deceee33a36dc38716351a05da6a26a13866
SHA512

fd299aae53f44e065c28e4cdb29665ad0a02ff4ccea3d6c0d98a9f4e8890594c560f8ae3f56bc611d974076929d2af0d64ddd68c1d58f6b093466d76e2fd521c
SSDEEP

24576:vptIP369oQVAbP0u9tSkrmLJc87LvDA9s4bRVGsaRRqTKOwyLKMCFO:vpG3F6u0llLrA9zdVGs0RqvwOKMuO

Score

10^/10

Malware Config

Extracted

Family

netwire

C2

banqueislamik.ddrive.online:3360

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
SALUT
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Targets

- Target
  
  2b1245c4547eee5a4545431f1969ab4dd5ba8ac4d0d2dd758d3c77a250e6ddb8.zip
- Size
  
  1.1MB
- MD5
  
  4ea1869e9fa0e523bf0df8cf13d4c6c1
- SHA1
  
  75b82d430f4424e146125286edb0d730e358b283
- SHA256
  
  52f9d316545f41cf9c29abdeedf5deceee33a36dc38716351a05da6a26a13866
- SHA512
  
  fd299aae53f44e065c28e4cdb29665ad0a02ff4ccea3d6c0d98a9f4e8890594c560f8ae3f56bc611d974076929d2af0d64ddd68c1d58f6b093466d76e2fd521c
- SSDEEP
  
  24576:vptIP369oQVAbP0u9tSkrmLJc87LvDA9s4bRVGsaRRqTKOwyLKMCFO:vpG3F6u0llLrA9zdVGs0RqvwOKMuO
Score

10^/10

netwire botnet persistence rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1
- Target
  
  2b1245c4547eee5a4545431f1969ab4dd5ba8ac4d0d2dd758d3c77a250e6ddb8.exe
- Size
  
  1.3MB
- MD5
  
  5c9ad0440fefa31403bd944a1a10a3b8
- SHA1
  
  2707299e9ec7fb2173f6afb2e23a4d74865cf5a3
- SHA256
  
  2b1245c4547eee5a4545431f1969ab4dd5ba8ac4d0d2dd758d3c77a250e6ddb8
- SHA512
  
  9b5b620be47d31f652d0100d891808f9b6baff7177c17604be6b0eb9cc731737e610ff47f83ffe8b9f50da48107087be06e74b75347f8d460b35a83d366c1078
- SSDEEP
  
  24576:AemBdOxLFDApSPKk48wxpb4YLDrvomDMzqZB:0BiLFssPH48ApZDrYzq
Score

10^/10

netwire botnet persistence rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral2