Extracted

• • Target

    add5d7ea43e8d2e4ca5334fc8df769f9

  • Size

    1008KB

  • MD5

    add5d7ea43e8d2e4ca5334fc8df769f9

  • SHA1

    632b823fe500f8adc8511b5371e6da697cdbbe08

  • SHA256

    da4e9c5b477efe56f29cacaef8591eef0b175829c6d1cbe4687b2ecf4174d267

  • SHA512

    f50de4eacfd94921a8566a601812a21671c613fe0fb917b18026c0f2744b2f58c45102f61a7a2783f519cc1386a70166dc8cb186a4298def98cc811d4d9eb405

  • SSDEEP

    12288:1EkCdOy3vVrKxR5CXbNjAOxK/j2n+4YG/6c1mFFja3mXgcjfRlgsUBga/77395Ya:1EkCdxte/80jYLT3U1jfsWaz737R/UQ

  Score

  10^/10

  netwirebotnetratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Blocklisted process makes network request

  • Drops startup file

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2