Overview

overview

10

Static

static

3

534377e8ad...f5.exe

windows7-x64

10

534377e8ad...f5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5

  • Size

    168KB

  • Sample

    240410-m3c8vsdc72

  • MD5

    ac65e7d08e48c6d20e3f90f7d9f73d8b

  • SHA1

    1dc7aa5ededab0009c6e693d2f713da4fd85cb17

  • SHA256

    534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5

  • SHA512

    8ca3bda79d5427d2476e5ea2a20682c76c4dc34673f36b1499cc492d1bd2a31be24a45b9a15e15f28de92c1aa48256722814b2d6827de606f4e907595f16e372

  • SSDEEP

    3072:2wUTTMqqDLy/0hSO4aMH8s/0K/dM7ry4VtmOo/KhtLL1YZYTb7Qw5:3qqDLu0hSjau/0K/UW47JrLxQ

Score
10/10
latentbotnetwirebotnetratstealertrojanupx

Malware Config

Extracted

Family

netwire

C2

atlaswebportal.zapto.org:4000

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    1.6_R1_18.06.16

  • keylogger_dir

    C:\NVIDIA\profile\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Micr0s0ft4456877

  • registry_autorun

    false

  • use_mutex

    false

Extracted

Family

latentbot

C2

atlaswebportal.zapto.org

Targets

    • Target

      534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5

    • Size

      168KB

    • MD5

      ac65e7d08e48c6d20e3f90f7d9f73d8b

    • SHA1

      1dc7aa5ededab0009c6e693d2f713da4fd85cb17

    • SHA256

      534377e8adc7b7d642c9c9177fd4e4cdc1eab0feca142e059eb21bbbdee0e3f5

    • SHA512

      8ca3bda79d5427d2476e5ea2a20682c76c4dc34673f36b1499cc492d1bd2a31be24a45b9a15e15f28de92c1aa48256722814b2d6827de606f4e907595f16e372

    • SSDEEP

      3072:2wUTTMqqDLy/0hSO4aMH8s/0K/dM7ry4VtmOo/KhtLL1YZYTb7Qw5:3qqDLu0hSjau/0K/UW47JrLxQ

    Score
    10/10
    netwirebotnetratstealerupxlatentbottrojan

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

      trojanlatentbot

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks