Extracted

• • Target

    SHIPPING DOCUMENTS.exe

  • Size

    719KB

  • MD5

    73c8dc59cfccfba80cce3a49581b4bda

  • SHA1

    6eeea6102a8e567a3a8131848071d30c914cb157

  • SHA256

    7b008555d37ba7bf03a502e216f6c822e36fd6fe9a8299bd6fd5fe66bbfb412a

  • SHA512

    dbd423ec1aab93e9248cfc9881ba103dc0715435ab9f22db7f955430b4d53c19efae5d68cb1058ce732284937b3e212ef429430c2dadc744d09b4ed21a1a76d9

  • SSDEEP

    12288:WJ8ql1aT4cYRt4ytVRO2xS5tMSnBZ0ihPw+OZi9709iDACMBPTGtT4APgV:u8ql4T4nU0RO2xScSBSKfOZ

  Score

  10^/10

  netwirebotnetdiscoveryevasionpersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Looks for VirtualBox Guest Additions in registry

    evasion

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Looks for VMWare Tools registry key

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Uses the VBS compiler for execution

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2