Overview

overview

10

Static

static

0760810fdc...ef.exe

windows7-x64

10

0760810fdc...ef.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0760810fdc8c99d629c3bbdb9baa375c3cb9a2c6e8d52d9c42941e6483cc55ef

  • Size

    218KB

  • Sample

    221127-ayr51abe2x

  • MD5

    9e90b8196b1979b337be4c7c24111f7f

  • SHA1

    0834f7c90373e59abdba656e8a73502c664e7534

  • SHA256

    0760810fdc8c99d629c3bbdb9baa375c3cb9a2c6e8d52d9c42941e6483cc55ef

  • SHA512

    b6882e25484a12790b465161dfa7a63f8de8dc6702b36a1b2b9a1c274e3fa3cc208d62bf7c410fa7fad9cff48980fe22b82cec2e7cf6cd8cc6be7b7f3d1719db

  • SSDEEP

    3072:XOvK93lmpPX2yKCL4Z/0BCpmSmSDByjivPPyY1GQ62VGNAj:XjMPX2yK1/qsmSmSDUuHKH/

Score
10/10
netwirebotnetratstealer

Malware Config

Targets

    • Target

      0760810fdc8c99d629c3bbdb9baa375c3cb9a2c6e8d52d9c42941e6483cc55ef

    • Size

      218KB

    • MD5

      9e90b8196b1979b337be4c7c24111f7f

    • SHA1

      0834f7c90373e59abdba656e8a73502c664e7534

    • SHA256

      0760810fdc8c99d629c3bbdb9baa375c3cb9a2c6e8d52d9c42941e6483cc55ef

    • SHA512

      b6882e25484a12790b465161dfa7a63f8de8dc6702b36a1b2b9a1c274e3fa3cc208d62bf7c410fa7fad9cff48980fe22b82cec2e7cf6cd8cc6be7b7f3d1719db

    • SSDEEP

      3072:XOvK93lmpPX2yKCL4Z/0BCpmSmSDByjivPPyY1GQ62VGNAj:XjMPX2yK1/qsmSmSDUuHKH/

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks