netwire | NEAS[.]ec191796f42d6366771fac4ccb16e640[.]exe | Triage

Sharing

General

Target

NEAS.ec191796f42d6366771fac4ccb16e640.exe
Size

176KB
MD5

ec191796f42d6366771fac4ccb16e640
SHA1

173e1466ca9955c0b07f4b8f10182ba85a80a74a
SHA256

603b46889f0468238d3f376269685ce71a1dadb299b07670e6e097dd55416a2f
SHA512

8847d75a96bc44d3fe8374c56fd0e1a4848a97d767e9e51f901282a18f08d4a651cce769db383df5b69498b00de03d918f215239d3115686819b4eb2852cf9f3
SSDEEP

3072:dt5SKzF0Lh9a7IGW9GHeOFVvc3rD8zKSG:fUSRAGH/7vc3r4zKS

Score

10^/10

rat netwire

Malware Config

Signatures

NetWire RAT payload 1 IoCs

resource	yara_rule
sample	netwire

Netwire family
netwire

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NEAS.ec191796f42d6366771fac4ccb16e640.exe

Files

NEAS.ec191796f42d6366771fac4ccb16e640.exe
.exe windows:4 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 25KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 49B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ