Extracted

• • Target

    3aece3473d0dc78b33efce273ac23626

  • Size

    1.2MB

  • MD5

    3aece3473d0dc78b33efce273ac23626

  • SHA1

    64b35b31e90f6d569df2195f312f31d0d499a971

  • SHA256

    ddb36550d76aab46cf84a855f0e242d45a7fa4576f1b162fcf41026defecdc3d

  • SHA512

    77e81bf73fd795c9ece63b1eb8d0021bfaee3b6ac64d6cbe5a758e69666969b26451958622e9a2ac1fe00f4f907f2d69238c8b1cfa6cd5887e6bc83cff7d9284

  • SSDEEP

    24576:1AOcZu3wPvjWH0+74RZ5bM3+vT9TFsXc6z1F/iI:/NGjx+8m3uT9TWM6z1F/D

  Score

  10^/10

  netwirebotnetpersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2