netwire | 767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0 | Triage

Sharing

General

Target

767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0
Size

1.1MB
Sample

221108-tt369afed3
MD5

0c943a457f91fb4ccaced2fdc5bd88fa
SHA1

1377fb46313fbb1df30480f732c63f8ee89d3415
SHA256

767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0
SHA512

1f2ee8067a072785cbd2553b2e3e91580b38dd299be16d528b18ff1a7487cb42ae5de759c95a02019937fdc8f459042391c6be3043615471e87b90944af09d33
SSDEEP

24576:GoWRZYsIATu0rwZUrDCmAzvV1ONMUo0GTcQpvD65cVJFiFtIR:3WnYJKxrw2ruxDV+LGTFEtIR

Score

10^/10

netwire botnet persistence rat stealer

Malware Config

Targets

- Target
  
  767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0
- Size
  
  1.1MB
- MD5
  
  0c943a457f91fb4ccaced2fdc5bd88fa
- SHA1
  
  1377fb46313fbb1df30480f732c63f8ee89d3415
- SHA256
  
  767cc57e463c997bd45e3f942f544e314ca377bf4f293d58b1f82b54c6e092f0
- SHA512
  
  1f2ee8067a072785cbd2553b2e3e91580b38dd299be16d528b18ff1a7487cb42ae5de759c95a02019937fdc8f459042391c6be3043615471e87b90944af09d33
- SSDEEP
  
  24576:GoWRZYsIATu0rwZUrDCmAzvV1ONMUo0GTcQpvD65cVJFiFtIR:3WnYJKxrw2ruxDV+LGTFEtIR
Score

10^/10

netwire botnet persistence rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

netwirebotnetpersistenceratstealer

behavioral2

netwirebotnetpersistenceratstealer