netwire | 0x00080000000122ee-67[.]dat

Sharing

Copy URL Twitter E-mail

General

Target
0x00080000000122ee-67.dat
Size 89KB
Sample230618-j83txsec76
SHA256 7231c7a76d9c4d0a307197522a2aec968f31865a4b2c4b962b64b01e9229315b
MD5 9c393cac6ef1c3282e3daf6ec50b79de
SHA1 34afa77f3d276191c278d56fa870d11c5069f48e
SHA512 82543c3b43d10616ff9687e468ab75f3e96d0f0fdc795df2ef341b91c4ef915b0bad5bfbf6916939d40596d9bcd3190a1371bced3be16513768cc096c9c9b66e
SSDEEP 1536:b2giUJrMJvmpUMyB43RWKRaQ71XubjyKhkkIs1ZZsNIT/SDhw:b2LiQmpUbB4kKP1Xubjy4Is1ZwIcw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat netwire

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
sample	netwire

Netwire family
netwire

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0x00080000000122ee-67.dat

File Explorer

0x00080000000122ee-67.dat

.exe 89KB

0x00080000000122ee-67.dat

IMPHASH 8e97a1515090baa46f52cf0ff6a6d12f
SHA256 7231c7a76d9c4d0a307197522a2aec968f31865a4b2c4b962b64b01e9229315b
MD5 9c393cac6ef1c3282e3daf6ec50b79de
SHA1 34afa77f3d276191c278d56fa870d11c5069f48e
SHA512 82543c3b43d10616ff9687e468ab75f3e96d0f0fdc795df2ef341b91c4ef915b0bad5bfbf6916939d40596d9bcd3190a1371bced3be16513768cc096c9c9b66e
SSDEEP 1536:b2giUJrMJvmpUMyB43RWKRaQ71XubjyKhkkIs1ZZsNIT/SDhw:b2LiQmpUbB4kKP1Xubjy4Is1ZwIcw
MD5 SHA1 SHA512 SSDEEP

windows x86

NetWire RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8906

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

crypt32

CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

kernel32

CloseHandle CreateDirectoryA CreateFileA CreateMutexA CreatePipe CreateProcessA CreateToolhelp32Snapshot DeleteFileA EnterCriticalSection ExitProcess FileTimeToSystemTime FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetComputerNameA GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExA GetDriveTypeA GetFileAttributesA GetFileAttributesExA GetLastError GetLocalTime GetLogicalDriveStringsA GetModuleFileNameA GetProcAddress GetProcessTimes GetStartupInfoA GetSystemInfo GetSystemTime GetTickCount GetVersionExA GetVolumeInformationA InitializeCriticalSection LeaveCriticalSection LoadLibraryA LocalFree MoveFileA OpenProcess PeekNamedPipe Process32First Process32Next ReadFile ReleaseMutex ResumeThread SetErrorMode SetFileAttributesA SetFilePointer Sleep TerminateProcess WideCharToMultiByte WriteFile

msvcrt

_beginthreadex _filelengthi64 _vscprintf _vsnprintf calloc fclose fflush fgetpos fgets fopen fread free fsetpos fwrite getenv malloc realloc strcat strchr strcpy

netapi32

NetApiBufferFree NetWkstaGetInfo

shell32

SHFileOperationA

user32

CreateWindowExA DefWindowProcA DispatchMessageA EnumWindows GetDC GetDesktopWindow GetForegroundWindow GetKeyNameTextA GetKeyState GetKeyboardState GetMessageA GetSystemMetrics GetWindowTextA IsWindowVisible MapVirtualKeyA PostQuitMessage RegisterClassExA ReleaseDC SendMessageA SetCursorPos SetWindowTextA ShowWindow ToAscii TranslateMessage keybd_event mouse_event

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSAStartup __WSAFDIsSet closesocket connect gethostbyname gethostname htons inet_ntoa ioctlsocket ntohs recv select send setsockopt shutdown socket