netwire | NEAS[.]8100b5b13207ebeadb2de6a086de1950[.]exe

General

Target
NEAS.8100b5b13207ebeadb2de6a086de1950.exe
Size 176KB
Sample231109-2qs6wage65
SHA256 582bc064f689cbcbd7227a153a0a14c0cb4132aed77f38b82ce3c783fd843ec6
MD5 8100b5b13207ebeadb2de6a086de1950
SHA1 d915533ad021d6065e1389e9ed349393c89c148c
SHA512 aa2e7f370282ccb1f9f108cb229ddae6186b179f29c4576a2a93e4c297dcad335c330039928790c4c07345f0ef95a69a3a8ba821404f455a20558d3d412c666f
SSDEEP 3072:dt5SKzF0Lh9a7IGW9GHeOFVvc3rDbrKSG:fUSRAGH/7vc3r/rKS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat netwire

Malware Config

Signatures

NetWire RAT payload 1 IoCs

rat

resource	yara_rule
sample	netwire

Netwire family
netwire

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.8100b5b13207ebeadb2de6a086de1950.exe

File Explorer

NEAS.8100b5b13207ebeadb2de6a086de1950.exe

.exe 176KB

NEAS.8100b5b13207ebeadb2de6a086de1950.exe

SHA256 582bc064f689cbcbd7227a153a0a14c0cb4132aed77f38b82ce3c783fd843ec6
MD5 8100b5b13207ebeadb2de6a086de1950
SHA1 d915533ad021d6065e1389e9ed349393c89c148c
SHA512 aa2e7f370282ccb1f9f108cb229ddae6186b179f29c4576a2a93e4c297dcad335c330039928790c4c07345f0ef95a69a3a8ba821404f455a20558d3d412c666f
SSDEEP 3072:dt5SKzF0Lh9a7IGW9GHeOFVvc3rDbrKSG:fUSRAGH/7vc3r/rKS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86

NetWire RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11211

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

49B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

NEAS.8100b5b13207ebeadb2de6a086de1950.exe

generic