Overview

overview

10

Static

static

3

eb90ecee5e...c6.exe

windows7-x64

1

eb90ecee5e...c6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eb90ecee5e9c8b158b4406accdf0fc29c54b468920bf555bea113d0f3dffe5c6

  • Size

    176KB

  • Sample

    240410-r5dpmabf65

  • MD5

    bee81874f719d61093f7ce12b2641ee4

  • SHA1

    3e3411df22faf8fd8425088f9ce63e6623f21b7a

  • SHA256

    eb90ecee5e9c8b158b4406accdf0fc29c54b468920bf555bea113d0f3dffe5c6

  • SHA512

    77726c75947153635e703f175f2f651531ae32d8a17853ce00c913f4f62b679d54a6de978c18dced08597a98b8d1e9e3dbc051b38687bb68c1c58be8dee09727

  • SSDEEP

    3072:2NDMqqDLy/QmYhXCBe0WQku/8Tx14D9D0vtn+dD16JN:XqqDLuxkyBPpJgvt+dD16X

Score
10/10
latentbotnetwirebotnetratstealertrojan

Malware Config

Extracted

Family

netwire

C2

knudandersen.zapto.org:21000

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    UN_23.01.17

  • keylogger_dir

    C:\NVIDIA\profile\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    1@wi%252ReNd5y0576Z*

  • registry_autorun

    false

  • use_mutex

    false

Extracted

Family

latentbot

C2

knudandersen.zapto.org

Targets

    • Target

      eb90ecee5e9c8b158b4406accdf0fc29c54b468920bf555bea113d0f3dffe5c6

    • Size

      176KB

    • MD5

      bee81874f719d61093f7ce12b2641ee4

    • SHA1

      3e3411df22faf8fd8425088f9ce63e6623f21b7a

    • SHA256

      eb90ecee5e9c8b158b4406accdf0fc29c54b468920bf555bea113d0f3dffe5c6

    • SHA512

      77726c75947153635e703f175f2f651531ae32d8a17853ce00c913f4f62b679d54a6de978c18dced08597a98b8d1e9e3dbc051b38687bb68c1c58be8dee09727

    • SSDEEP

      3072:2NDMqqDLy/QmYhXCBe0WQku/8Tx14D9D0vtn+dD16JN:XqqDLuxkyBPpJgvt+dD16X

    Score
    10/10
    latentbotnetwirebotnetratstealertrojan

    • LatentBot

      Modular trojan written in Delphi which has been in-the-wild since 2013.

      trojanlatentbot

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks