Overview

overview

10

Static

static

d73c8fe975...f9.dll

windows7-x64

10

d73c8fe975...f9.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d73c8fe975a6697c3c61186d390c1422f802415256cba694ece4e92d65eca1f9

  • Size

    4.9MB

  • Sample

    230129-1tqdqafg7x

  • MD5

    4e1e49d1b75491ed572f5a7e0b2e0303

  • SHA1

    b84cacae02c34a23155bb562793db456e0c8bc23

  • SHA256

    d73c8fe975a6697c3c61186d390c1422f802415256cba694ece4e92d65eca1f9

  • SHA512

    e9e70cd057dbcffc50fb58fdc2944b3db9e68d142d7d320d07e0047917263f882dd00fe748d80b307e77af700d6b519cdf15f82e9c4155efd4b1cebab7e28559

  • SSDEEP

    98304:10fY0CspGCvRZFUhsGZtWttFsJObcFksHPlJF3t2GSVZQl2P:VTCZPkhxka5t2FEgP

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

escusemoisco.com:0990

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-smaaU0

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Password123

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      d73c8fe975a6697c3c61186d390c1422f802415256cba694ece4e92d65eca1f9

    • Size

      4.9MB

    • MD5

      4e1e49d1b75491ed572f5a7e0b2e0303

    • SHA1

      b84cacae02c34a23155bb562793db456e0c8bc23

    • SHA256

      d73c8fe975a6697c3c61186d390c1422f802415256cba694ece4e92d65eca1f9

    • SHA512

      e9e70cd057dbcffc50fb58fdc2944b3db9e68d142d7d320d07e0047917263f882dd00fe748d80b307e77af700d6b519cdf15f82e9c4155efd4b1cebab7e28559

    • SSDEEP

      98304:10fY0CspGCvRZFUhsGZtWttFsJObcFksHPlJF3t2GSVZQl2P:VTCZPkhxka5t2FEgP

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks