Overview

overview

10

Static

static

3

3e46148885...18.exe

windows7-x64

10

3e46148885...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e461488855f65ceefe255faf340def7_JaffaCakes118

  • Size

    252KB

  • Sample

    240513-hv496aee69

  • MD5

    3e461488855f65ceefe255faf340def7

  • SHA1

    e517091c4a1565fec8c91b014baa94fa11561650

  • SHA256

    c6af2f075148a6c62a0e389f293dfb04d3e5d5c0e8280431e3f9ff3e940bde8e

  • SHA512

    8f397b8c27bd7e45f0e6cc7a7cfd1af9ceccffb0b2c06c40869e14c4342d475ef9549a433446ac4587956a08bfab61c4a85d5379c8816350271ae71c7795e23e

  • SSDEEP

    6144:oE56P/i5P4dNtURdebDT122lgQ5mG9fR:p5UKcNtcS5mG9

Score
10/10
netwirebotnetpersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

info1.nowddns.com:5552

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    NOW-DNS-5552

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    gqmQdKHu

  • offline_keylogger

    true

  • password

    caster123

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      3e461488855f65ceefe255faf340def7_JaffaCakes118

    • Size

      252KB

    • MD5

      3e461488855f65ceefe255faf340def7

    • SHA1

      e517091c4a1565fec8c91b014baa94fa11561650

    • SHA256

      c6af2f075148a6c62a0e389f293dfb04d3e5d5c0e8280431e3f9ff3e940bde8e

    • SHA512

      8f397b8c27bd7e45f0e6cc7a7cfd1af9ceccffb0b2c06c40869e14c4342d475ef9549a433446ac4587956a08bfab61c4a85d5379c8816350271ae71c7795e23e

    • SSDEEP

      6144:oE56P/i5P4dNtURdebDT122lgQ5mG9fR:p5UKcNtcS5mG9

    Score
    10/10
    netwirebotnetpersistenceratstealer

    • Modifies WinLogon for persistence

      persistence

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks