Overview

overview

10

Static

static

b56e1c1adc...30.exe

windows7-x64

10

b56e1c1adc...30.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b56e1c1adcdf65f0f4dc9244bc896f1fafd50baf0f1cdedefd4987bd1e22d730

  • Size

    198KB

  • Sample

    221127-p889ladd9w

  • MD5

    77ad8fe3892798dc43c80721c6406765

  • SHA1

    71033206a526d262852c419b24632c614a3056b8

  • SHA256

    b56e1c1adcdf65f0f4dc9244bc896f1fafd50baf0f1cdedefd4987bd1e22d730

  • SHA512

    b349d7058d49bc456aa42e5e47a187eaf33ee9e5aa305e0d320b7a1507c0c71a2421e94a0fd7c36b4f74f34d9812c1d6c42ed08658268b5aa6e877b42962338b

  • SSDEEP

    6144:TQmU+VV0R7iePp++tQb+anxEv7M9K+oDV:kF+VV0R7iex++ENxOAwD

Score
10/10
netwirebotnetratstealer

Malware Config

Targets

    • Target

      b56e1c1adcdf65f0f4dc9244bc896f1fafd50baf0f1cdedefd4987bd1e22d730

    • Size

      198KB

    • MD5

      77ad8fe3892798dc43c80721c6406765

    • SHA1

      71033206a526d262852c419b24632c614a3056b8

    • SHA256

      b56e1c1adcdf65f0f4dc9244bc896f1fafd50baf0f1cdedefd4987bd1e22d730

    • SHA512

      b349d7058d49bc456aa42e5e47a187eaf33ee9e5aa305e0d320b7a1507c0c71a2421e94a0fd7c36b4f74f34d9812c1d6c42ed08658268b5aa6e877b42962338b

    • SSDEEP

      6144:TQmU+VV0R7iePp++tQb+anxEv7M9K+oDV:kF+VV0R7iex++ENxOAwD

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks