Overview

overview

10

Static

static

3

6905b9a6b3...86.exe

windows7-x64

10

6905b9a6b3...86.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6905b9a6b31ab4fee60d50165318d52e49e0883e1ec1e93133b4a0722cbb7686

  • Size

    232KB

  • Sample

    240410-nsmvzsec37

  • MD5

    e6714e3bd83b4a349ab48cc203b91813

  • SHA1

    5f691a8f917a30129dfba99513648b884521caba

  • SHA256

    6905b9a6b31ab4fee60d50165318d52e49e0883e1ec1e93133b4a0722cbb7686

  • SHA512

    903bb279293d8d9f99dd1fd5eb1c98d1e0379c06677d97e3f7dbab3790f2fa90c582c55a73b32117c627ded1c6dfd8fb6e7502757d8725882b6c1bbab5de96e3

  • SSDEEP

    6144:fqqDLuH5Qq1BpPrWCFb26J7XUsf32v8ysFsi:CqnuZxfFb9Oncsi

Score
10/10
latentbotnetwirebotnetratstealertrojan

Malware Config

Extracted

Family

netwire

C2

atlaswebportal.zapto.org:4000

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    R5_04.08.16_02

  • keylogger_dir

    C:\NVIDIA\profile\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Micr0s0ft4456877

  • registry_autorun

    false

  • use_mutex

    false

Extracted

Family

latentbot

C2

atlaswebportal.zapto.org

Targets

    • Target

      6905b9a6b31ab4fee60d50165318d52e49e0883e1ec1e93133b4a0722cbb7686

    • Size

      232KB

    • MD5

      e6714e3bd83b4a349ab48cc203b91813

    • SHA1

      5f691a8f917a30129dfba99513648b884521caba

    • SHA256

      6905b9a6b31ab4fee60d50165318d52e49e0883e1ec1e93133b4a0722cbb7686

    • SHA512

      903bb279293d8d9f99dd1fd5eb1c98d1e0379c06677d97e3f7dbab3790f2fa90c582c55a73b32117c627ded1c6dfd8fb6e7502757d8725882b6c1bbab5de96e3

    • SSDEEP

      6144:fqqDLuH5Qq1BpPrWCFb26J7XUsf32v8ysFsi:CqnuZxfFb9Oncsi

    Score
    10/10
    netwirebotnetratstealerlatentbottrojan

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

      trojanlatentbot

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks