Overview

overview

10

Static

static

3

818fc8fd60...53.exe

windows7-x64

10

818fc8fd60...53.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    818fc8fd60958dd2d68e78901d9ca853

  • Size

    3.1MB

  • Sample

    231226-wbsznsbcdm

  • MD5

    818fc8fd60958dd2d68e78901d9ca853

  • SHA1

    f030dc87346b8ba067cfcbf2cd65a4ce5b6c4ccb

  • SHA256

    8be6f3a09608b6d9243c599e2e8fa46e8fc81b341ba7b02c84aad2e7d2e0dac2

  • SHA512

    68e52959162505709f2037a98e725ee29cb8c2e46fb76715b777fc6d96b62c53171db938191eb3a211567702330c23732dc616a1403034b853e7eb9b6df4e95d

  • SSDEEP

    49152:eV8Rh1twb/zOidNeQlRzOcD34FWSj6Vj1DQXNzwGQYYI:9PQzzr86dIL

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

sacsacsav.com:6060

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    ctMImXHq

  • offline_keylogger

    true

  • password

    Topgangz1.

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      818fc8fd60958dd2d68e78901d9ca853

    • Size

      3.1MB

    • MD5

      818fc8fd60958dd2d68e78901d9ca853

    • SHA1

      f030dc87346b8ba067cfcbf2cd65a4ce5b6c4ccb

    • SHA256

      8be6f3a09608b6d9243c599e2e8fa46e8fc81b341ba7b02c84aad2e7d2e0dac2

    • SHA512

      68e52959162505709f2037a98e725ee29cb8c2e46fb76715b777fc6d96b62c53171db938191eb3a211567702330c23732dc616a1403034b853e7eb9b6df4e95d

    • SSDEEP

      49152:eV8Rh1twb/zOidNeQlRzOcD34FWSj6Vj1DQXNzwGQYYI:9PQzzr86dIL

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks