Overview

overview

10

Static

static

3

84f1f621d4...18.exe

windows7-x64

10

84f1f621d4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    84f1f621d49f3492bb3fa019f3191435_JaffaCakes118

  • Size

    171KB

  • Sample

    240810-f4hfmsxejp

  • MD5

    84f1f621d49f3492bb3fa019f3191435

  • SHA1

    e5075b0bf2937b1f22102b4f46566f5fa10acb24

  • SHA256

    244397d4ec28114ed99e163dd9236e5f75ffd84540e7d16212d93508a3e7889c

  • SHA512

    8ecab39cc1b984eb6d2f1b337a99de66a666b9c32333800e53a2b1a7df378d4b65d81457d99a3b7da7501d1f0a25779f723f7d4ee89e23f6bafa8d2871f7a84c

  • SSDEEP

    3072:7FdEJIVzofEDRksPw6zCyOPhB5WobZanuD10biGKPaA+9uYGDugb/He:xd/3KxQMB/6k2bNA+9tGD5b

Score
10/10
netwirebotnetdiscoveryratstealer

Malware Config

Extracted

Family

netwire

C2

zicopele2018.sytes.net:3584

zicopele2018backup.sytes.net:3584
Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    vkRChWpP

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      84f1f621d49f3492bb3fa019f3191435_JaffaCakes118

    • Size

      171KB

    • MD5

      84f1f621d49f3492bb3fa019f3191435

    • SHA1

      e5075b0bf2937b1f22102b4f46566f5fa10acb24

    • SHA256

      244397d4ec28114ed99e163dd9236e5f75ffd84540e7d16212d93508a3e7889c

    • SHA512

      8ecab39cc1b984eb6d2f1b337a99de66a666b9c32333800e53a2b1a7df378d4b65d81457d99a3b7da7501d1f0a25779f723f7d4ee89e23f6bafa8d2871f7a84c

    • SSDEEP

      3072:7FdEJIVzofEDRksPw6zCyOPhB5WobZanuD10biGKPaA+9uYGDugb/He:xd/3KxQMB/6k2bNA+9tGD5b

    Score
    10/10
    netwirebotnetdiscoveryratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Drops startup file

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks