Overview

overview

10

Static

static

3

30c78639c4...24.exe

windows7-x64

10

30c78639c4...24.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24

  • Size

    296KB

  • Sample

    240410-l8fqhaca35

  • MD5

    ad1b6380efb0aad16f01bd1a23f2e649

  • SHA1

    09fc136cf022ea2fd176c1d8a6b6e2f8de54bd3d

  • SHA256

    30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24

  • SHA512

    2080a929ca0cc84c714d4085ee6c4f13fe4cc4aa809936bf8a596951134034d7ed0b2713a150b17916271f7b35ce2dcf19931128c6bf7fcf03a13604042919e9

  • SSDEEP

    6144:iqqDLuTz9dnBqi2viVlDaaf6QRHursR+EvtW7IkXVUWlvddk:XqnuTRAErSQd/vvp2

Score
10/10
latentbotnetwirebotnetratstealertrojan

Malware Config

Extracted

Family

netwire

C2

knudandersen.zapto.org:21000

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    07.03.17

  • keylogger_dir

    C:\NVIDIA\profile\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    1@wi%252ReNd5y0576Z*

  • registry_autorun

    false

  • use_mutex

    false

Extracted

Family

latentbot

C2

knudandersen.zapto.org

Targets

    • Target

      30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24

    • Size

      296KB

    • MD5

      ad1b6380efb0aad16f01bd1a23f2e649

    • SHA1

      09fc136cf022ea2fd176c1d8a6b6e2f8de54bd3d

    • SHA256

      30c78639c491bfdbb15b1d8e9c5032cd218d2eb37d27645e0789ee9997969e24

    • SHA512

      2080a929ca0cc84c714d4085ee6c4f13fe4cc4aa809936bf8a596951134034d7ed0b2713a150b17916271f7b35ce2dcf19931128c6bf7fcf03a13604042919e9

    • SSDEEP

      6144:iqqDLuTz9dnBqi2viVlDaaf6QRHursR+EvtW7IkXVUWlvddk:XqnuTRAErSQd/vvp2

    Score
    10/10
    latentbotnetwirebotnetratstealertrojan

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

      trojanlatentbot

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks