netwire | 0a165add91ed3c12af0e51039d67e5522ac4304a0eae5809ffbf85c957e60306 | Triage

Sharing

General

Target

1f62661bef1758808128adc9a1988f7f.exe
Size

160KB
Sample

230214-shv6tsdf9s
MD5

1f62661bef1758808128adc9a1988f7f
SHA1

a06be5f1bb80108a2c8222122836d214a68a46ad
SHA256

0a165add91ed3c12af0e51039d67e5522ac4304a0eae5809ffbf85c957e60306
SHA512

a4f872fb7885ff933a142557a582f389596d47913b7d5361328b6a01b7e991ef5deee402f78cc713badc11f645e17ff5b97ab67f68334ba7312d0d1a2d12609d
SSDEEP

3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLvPYMjMqqDvFf:jOTcK+NrRioGHlz8rz0i/PzQqqDvFf

Score

10^/10

netwire botnet rat stealer

Malware Config

Extracted

Family

netwire

C2

5.39.223.27:3360

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
OwuNZ-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
7cdeH2K5U4
registry_autorun
false
use_mutex
false

Targets

- Target
  
  1f62661bef1758808128adc9a1988f7f.exe
- Size
  
  160KB
- MD5
  
  1f62661bef1758808128adc9a1988f7f
- SHA1
  
  a06be5f1bb80108a2c8222122836d214a68a46ad
- SHA256
  
  0a165add91ed3c12af0e51039d67e5522ac4304a0eae5809ffbf85c957e60306
- SHA512
  
  a4f872fb7885ff933a142557a582f389596d47913b7d5361328b6a01b7e991ef5deee402f78cc713badc11f645e17ff5b97ab67f68334ba7312d0d1a2d12609d
- SSDEEP
  
  3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLvPYMjMqqDvFf:jOTcK+NrRioGHlz8rz0i/PzQqqDvFf
Score

10^/10

netwire botnet stealer
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

netwirebotnetstealer

behavioral2

netwirebotnetstealer