Overview

overview

10

Static

static

10

cde1062d7b...fb.exe

windows7-x64

10

cde1062d7b...fb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    80dd215aabe5b7e902f2cb64cd77049011637ec3f65dc00782dab64a1c57c536

  • Size

    41KB

  • MD5

    34afe8b10bf209473c1313939df43c35

  • SHA1

    027600481200c9d74417786b450be471d9de7e02

  • SHA256

    80dd215aabe5b7e902f2cb64cd77049011637ec3f65dc00782dab64a1c57c536

  • SHA512

    0de987421357527325df017babb771f7364309c3814ed06757345939601cc5d3c4c312dd4dde796b56f7766615ef436742daed4336f33cc5f1b11011df1f0a6c

  • SSDEEP

    768:4fbfyk6Yo2cOchNMhGnhtzDUkadBNbxDOKFJG1/SW5ziU3utXr/tmFJmJlCWoN6S:g9oGoWhGHzDNGZxDOKFJJWAU3utJmFJz

Score
10/10
ratnetwire

Malware Config

Extracted

Family

netwire

C2

abi.asu.su:2525

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    abi

  • lock_executable

    false

  • offline_keylogger

    false

  • password

    Somma2009

  • registry_autorun

    false

  • use_mutex

    false

Signatures

  • NetWire RAT payload 1 IoCs
    rat
  • Netwire family
    netwire
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 80dd215aabe5b7e902f2cb64cd77049011637ec3f65dc00782dab64a1c57c536
    .zip

    Password: infected

  • cde1062d7bacd1795c61dae09435a2affc75e9f5f7f0eeae581f687130af46fb
    .exe windows:4 windows x86 arch:x86

    eaf9915d2b5730c3717ea003bd93404a


    Headers

    Imports

    Sections