netwire | bbcd69462fe551365f46a41a6572a1740ba587eb6569a54a12f98e7f95679720 | Triage

Submit
Reports

Overview

overview

Static

static

bbcd69462f...20.exe

windows7-x64

bbcd69462f...20.exe

windows10-2004-x64

Sharing

General

Target

bbcd69462fe551365f46a41a6572a1740ba587eb6569a54a12f98e7f95679720
Size

254KB
Sample

221128-xntx6shd24
MD5

3ff0b937603dfcb9c81a7e231617b2e0
SHA1

30a05130052ca39c3d82270b41f4e663697682e2
SHA256

bbcd69462fe551365f46a41a6572a1740ba587eb6569a54a12f98e7f95679720
SHA512

a5847b4803dcf7e1652b88340c7ae497f6c60ff54e5cae4cdb13ab686df42c9dd433fe2032c8f72ebc1aa445cf2caa0aaa2e1afc462b8a8e6378fb94d697cf17
SSDEEP

6144:1+rKY7Y82tN3HIcU15+OfAnITjS3lG9cuwn:1R3HIx18OfAnITes9E

Score

10^/10

netwire botnet persistence rat stealer upx

Static task

static1

Behavioral task

behavioral1

Sample

bbcd69462fe551365f46a41a6572a1740ba587eb6569a54a12f98e7f95679720.exe

Resource

win7-20220812-en

netwire botnet persistence rat stealer upx

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

bbcd69462fe551365f46a41a6572a1740ba587eb6569a54a12f98e7f95679720.exe

Resource

win10v2004-20220812-en

netwire botnet persistence rat stealer upx

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  
  bbcd69462fe551365f46a41a6572a1740ba587eb6569a54a12f98e7f95679720
- Size
  
  254KB
- MD5
  
  3ff0b937603dfcb9c81a7e231617b2e0
- SHA1
  
  30a05130052ca39c3d82270b41f4e663697682e2
- SHA256
  
  bbcd69462fe551365f46a41a6572a1740ba587eb6569a54a12f98e7f95679720
- SHA512
  
  a5847b4803dcf7e1652b88340c7ae497f6c60ff54e5cae4cdb13ab686df42c9dd433fe2032c8f72ebc1aa445cf2caa0aaa2e1afc462b8a8e6378fb94d697cf17
- SSDEEP
  
  6144:1+rKY7Y82tN3HIcU15+OfAnITjS3lG9cuwn:1R3HIx18OfAnITes9E
Score

10^/10

netwire botnet persistence rat stealer upx
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Modifies Installed Components in the registry
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

netwirebotnetpersistenceratstealerupx

behavioral2

netwirebotnetpersistenceratstealerupx

© 2018-2024

Terms | Privacy