Overview

overview

10

Static

static

3

27146b9d53...18.exe

windows7-x64

10

27146b9d53...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    27146b9d5392c06bbce1b6bf4ba19d6f_JaffaCakes118

  • Size

    948KB

  • Sample

    240508-2rb9rabg21

  • MD5

    27146b9d5392c06bbce1b6bf4ba19d6f

  • SHA1

    5fc7ca59fb684a32968037cf5a59d86cee985c57

  • SHA256

    72c91527b816eff4305a106caa14e4c8335466f92617c9dd6957e44f66ead4d5

  • SHA512

    0c299ed0f859461df76d19e3869027f026931b8df7af05bd42010cf16968cfe27a161cb13a1d4a5df13c1021b25fec33c4d17713d97ba0648ca17ce30ad31153

  • SSDEEP

    6144:oPofUJzujfzIHKGgzs9Wv5znnsu6oIT/OyVfVgdH:oPoBIHIzsuNsu6ow7VS

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

alibabajob.duckdns.org:1719

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    nvkUYhiE

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      27146b9d5392c06bbce1b6bf4ba19d6f_JaffaCakes118

    • Size

      948KB

    • MD5

      27146b9d5392c06bbce1b6bf4ba19d6f

    • SHA1

      5fc7ca59fb684a32968037cf5a59d86cee985c57

    • SHA256

      72c91527b816eff4305a106caa14e4c8335466f92617c9dd6957e44f66ead4d5

    • SHA512

      0c299ed0f859461df76d19e3869027f026931b8df7af05bd42010cf16968cfe27a161cb13a1d4a5df13c1021b25fec33c4d17713d97ba0648ca17ce30ad31153

    • SSDEEP

      6144:oPofUJzujfzIHKGgzs9Wv5znnsu6oIT/OyVfVgdH:oPoBIHIzsuNsu6ow7VS

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Drops startup file

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks