netwire

General

Target

43ed291cccfc3d31bbb01e7ac7c28c83_JaffaCakes118
Size

203KB
Sample

240515-bmqy8shh21
MD5

43ed291cccfc3d31bbb01e7ac7c28c83
SHA1

224c53321af6f3b7ac43889c8394577d94c38963
SHA256

091b82a4ba69c0c3f5419e529a6a8627199cf8b01d64214a60ec16ee603e60c0
SHA512

fa3954d1aa4735996c923b6ebbd3def1142f379cc1cc1a2926eed8844adad839aee76c4d9eb6bcc32924d99e61b85e8a220bad1cd90a1e37cfe25aa1be6a9d54
SSDEEP

6144:D1onxwmWBbeEAev/25KFWJ3iiew9F9gZZbf:hoxwJP251iibaf

Score

10^/10

Malware Config

Extracted

Family

netwire

C2

ddns.catamosky.biz:4886

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
APRIL
install_path
%AppData%\Install\Hostiuj.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
fhYmpchh
offline_keylogger
true
password
Trinidado1@
registry_autorun
true
startup_name
hostiuj
use_mutex
true

Targets

- Target
  
  43ed291cccfc3d31bbb01e7ac7c28c83_JaffaCakes118
- Size
  
  203KB
- MD5
  
  43ed291cccfc3d31bbb01e7ac7c28c83
- SHA1
  
  224c53321af6f3b7ac43889c8394577d94c38963
- SHA256
  
  091b82a4ba69c0c3f5419e529a6a8627199cf8b01d64214a60ec16ee603e60c0
- SHA512
  
  fa3954d1aa4735996c923b6ebbd3def1142f379cc1cc1a2926eed8844adad839aee76c4d9eb6bcc32924d99e61b85e8a220bad1cd90a1e37cfe25aa1be6a9d54
- SSDEEP
  
  6144:D1onxwmWBbeEAev/25KFWJ3iiew9F9gZZbf:hoxwJP251iibaf
Score

10^/10

netwire botnet persistence rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1
  
  fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA256
  
  fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- SHA512
  
  0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP
  
  192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
Score

3^/10
behavioral3 behavioral4
- Target
  
  1LmY0t
- Size
  
  145KB
- MD5
  
  0e669c1cc4e6d878114e602f51fc9401
- SHA1
  
  1794efbe2fa3af19eccdbe0a48c5b24d48b2cda0
- SHA256
  
  c960265723d5e6247c9b416e49b8a993e424ad9e63ab539848bca32871d3c1bb
- SHA512
  
  9c99425bc5e5463ec35b86e503df1fa37b8599fb42c6b6729b761d68ad780726e31d6880d60c93e42721195c4f07e90f2f931496a6984ab46b1513253f07c65a
- SSDEEP
  
  3072:RTOmM7xVy8G+jMP938O6VBc5LCidMvp2oBWL7aZOR4:omzCMPF8pVBc5+iG9BW3aZOy
Score

3^/10

execution
behavioral5 behavioral6