Overview

overview

10

Static

static

ef251d895f...96.exe

windows7-x64

10

ef251d895f...96.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ef251d895fa2cf481065dc34e42df408d09a5cce29876f03b22d5a2194b82896

  • Size

    162KB

  • Sample

    221126-2zslpsbf57

  • MD5

    30c8ee8debc4c551cb8635335d4f2e1a

  • SHA1

    7ec19d823580469ccd38c47b3014dd9e189cee22

  • SHA256

    ef251d895fa2cf481065dc34e42df408d09a5cce29876f03b22d5a2194b82896

  • SHA512

    9517c58c149020b9ada930d8be1df556976b27b4da06def0dd939dd75f02dc0236f82aa97ecd335dde4430ac4247cb90f4accadcf391bf9024426af0daf7dc4c

  • SSDEEP

    3072:OqViHANsfr+sU/Ng9u05901zi4OAVfrJLI2OFVlVbC9J0GbFS+RRHlOHdflZItN:JiHcb/Ng9RdmJMm30Gbk+/kFnIt

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Targets

    • Target

      ef251d895fa2cf481065dc34e42df408d09a5cce29876f03b22d5a2194b82896

    • Size

      162KB

    • MD5

      30c8ee8debc4c551cb8635335d4f2e1a

    • SHA1

      7ec19d823580469ccd38c47b3014dd9e189cee22

    • SHA256

      ef251d895fa2cf481065dc34e42df408d09a5cce29876f03b22d5a2194b82896

    • SHA512

      9517c58c149020b9ada930d8be1df556976b27b4da06def0dd939dd75f02dc0236f82aa97ecd335dde4430ac4247cb90f4accadcf391bf9024426af0daf7dc4c

    • SSDEEP

      3072:OqViHANsfr+sU/Ng9u05901zi4OAVfrJLI2OFVlVbC9J0GbFS+RRHlOHdflZItN:JiHcb/Ng9RdmJMm30Gbk+/kFnIt

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks