Extracted

• • Target

    Cobaltbghdbghich14_browsingExe.exe

  • Size

    1.3MB

  • MD5

    55e3025122ba322bb9c5fc881ad05a92

  • SHA1

    88734ae99e0b76b5f63669d582f9138c0a7098ca

  • SHA256

    e933ec0f52cbc60b92134d48b08661b1af25c7d93ff5041fc704559b45bd85b8

  • SHA512

    20209b1fdc5008a3f8d2fb488802f8702f300a017fd6e37f88d72fd17db92a7d18c5bca34d9acbafabfedf7b1769a5cbcf11f2c48806c03cb1345126590a6759

  • SSDEEP

    24576:UeP/5CxBM9dOxLFDApSPKk48ULCW5Wq8USQKo+co4Jc1BR:B/5CxBM9iLFssPH482f5kPco4Jc

  Score

  10^/10

  netwirebotnetpersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2