Overview

overview

10

Static

static

d736c5b2ae...fe.exe

windows7-x64

10

d736c5b2ae...fe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe

  • Size

    2.4MB

  • Sample

    221130-t5rbtsah3s

  • MD5

    dc794c6baef5fa590421ac67e3d08a4b

  • SHA1

    3362ee2afdb1cf40830a8e3e3ec2dde1eb0887a0

  • SHA256

    d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe

  • SHA512

    08133ba467a25450a303323ddc21ac0697a75bf42ee80994dcc89161c1d7b03e3a9960c782d2126522076c115404492cf7490e5cbe979e1c2ba8baa895227cf6

  • SSDEEP

    49152:2JGhVJmzCDq35LO3mIp07KtjgRk0oqRuwSCFVPB9ZhhqDF8xLt9QQfBcWqeR+jl2:2gjLW8OjQ1a7

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

venezia-pl.myq-see.com:3737

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    February-2021

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    bQkxKHhm

  • offline_keylogger

    true

  • password

    ALANKA121

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe

    • Size

      2.4MB

    • MD5

      dc794c6baef5fa590421ac67e3d08a4b

    • SHA1

      3362ee2afdb1cf40830a8e3e3ec2dde1eb0887a0

    • SHA256

      d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe

    • SHA512

      08133ba467a25450a303323ddc21ac0697a75bf42ee80994dcc89161c1d7b03e3a9960c782d2126522076c115404492cf7490e5cbe979e1c2ba8baa895227cf6

    • SSDEEP

      49152:2JGhVJmzCDq35LO3mIp07KtjgRk0oqRuwSCFVPB9ZhhqDF8xLt9QQfBcWqeR+jl2:2gjLW8OjQ1a7

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Beds Protector Packer

      Detects Beds Protector packer used to load .NET malware.

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks