Overview

overview

10

Static

static

1

81f623714d...67.exe

windows10-2004-x64

10

81f623714d...67.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    81f623714de0a3dfb0a537b3be6e5fa52c23e4c530ef0f4bc3c38dc988f44d67

  • Size

    440KB

  • Sample

    240820-wfsjpsvhkh

  • MD5

    53fd837cce4527d93c5d4cf91f822155

  • SHA1

    59a5ecd6bc055784f05dbd7aa099a125bb9a0263

  • SHA256

    81f623714de0a3dfb0a537b3be6e5fa52c23e4c530ef0f4bc3c38dc988f44d67

  • SHA512

    877c9954e9de9f7afef2498999e067e8e41dfbeaff1bf878f1d5654153ef6afe99c3d0db5b75b254faaa5ad2517f53aacd2f9b84dbf85ad90e305cb13176fb0e

  • SSDEEP

    6144:YFb5HOviqia9rwJYJkh8qEnwoHo7YDh/GdTUpdTxk6zsVN3JRjN3Jw:g5HOvsSr8YJkPEw5ZT4d11cN3JRpJw

Score
10/10
netwirebotnetdiscoveryratstealer

Malware Config

Extracted

Family

netwire

C2

vad.invvipbooknowreverse.vladimir.ru:8079

vlad.securefoodlinkdownload.kz:8078

vlad.racordvasdems.su:8077
Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    NossSs-%Rand%

  • keylogger_dir

    %AppData%\Dobe\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    19891989

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      81f623714de0a3dfb0a537b3be6e5fa52c23e4c530ef0f4bc3c38dc988f44d67

    • Size

      440KB

    • MD5

      53fd837cce4527d93c5d4cf91f822155

    • SHA1

      59a5ecd6bc055784f05dbd7aa099a125bb9a0263

    • SHA256

      81f623714de0a3dfb0a537b3be6e5fa52c23e4c530ef0f4bc3c38dc988f44d67

    • SHA512

      877c9954e9de9f7afef2498999e067e8e41dfbeaff1bf878f1d5654153ef6afe99c3d0db5b75b254faaa5ad2517f53aacd2f9b84dbf85ad90e305cb13176fb0e

    • SSDEEP

      6144:YFb5HOviqia9rwJYJkh8qEnwoHo7YDh/GdTUpdTxk6zsVN3JRjN3Jw:g5HOvsSr8YJkPEw5ZT4d11cN3JRpJw

    Score
    10/10
    netwirebotnetdiscoveryratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks