Overview

overview

10

Static

static

3

bf7751dab2...4d.exe

windows7-x64

10

bf7751dab2...4d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf7751dab2b489bd1f3034b609779b4d

  • Size

    998KB

  • Sample

    240311-bn16lagg8s

  • MD5

    bf7751dab2b489bd1f3034b609779b4d

  • SHA1

    ee0f5a5fd0a29b06f7a6716ed261a3876541366f

  • SHA256

    ff2b159f4ca9611604db05a3ecc47311d64a08eeb157e023498b64543ba386e0

  • SHA512

    fa8efa576c55ea2f0b4b2a04907f8439d6a19dec7a3bc77e555417318bd12a29c12e0016b34b2fdb8d5b9c2293dc6c13823edab2ca3a2adef3081b1803cdf882

  • SSDEEP

    12288:ZcWqp30xRbKF8iFGCmjvXo3DK3PfLVw/dyZwcgslNMw0qhx9v6o4qGGWEhPTg8E9:nqpSQN2v4GHog/gslNMwvjSb3

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

6790netwire.geekgalaxy.com:6790

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      bf7751dab2b489bd1f3034b609779b4d

    • Size

      998KB

    • MD5

      bf7751dab2b489bd1f3034b609779b4d

    • SHA1

      ee0f5a5fd0a29b06f7a6716ed261a3876541366f

    • SHA256

      ff2b159f4ca9611604db05a3ecc47311d64a08eeb157e023498b64543ba386e0

    • SHA512

      fa8efa576c55ea2f0b4b2a04907f8439d6a19dec7a3bc77e555417318bd12a29c12e0016b34b2fdb8d5b9c2293dc6c13823edab2ca3a2adef3081b1803cdf882

    • SSDEEP

      12288:ZcWqp30xRbKF8iFGCmjvXo3DK3PfLVw/dyZwcgslNMw0qhx9v6o4qGGWEhPTg8E9:nqpSQN2v4GHog/gslNMwvjSb3

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks