Overview

overview

10

Static

static

3

c2d308657e...18.exe

windows7-x64

10

c2d308657e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c2d308657eccce04ab9e52c363df6e54_JaffaCakes118

  • Size

    235KB

  • Sample

    240826-mrbwnaygrh

  • MD5

    c2d308657eccce04ab9e52c363df6e54

  • SHA1

    867bd5b11cc8829f65a84b352fad5115c445b45f

  • SHA256

    cbc223f2c31975d75036610291b14193b98438d9e0629a4f9f83b5bf0f55234a

  • SHA512

    3f4b7e2cccb9d5837855db651f01a1b1b480e5474fa35b99ffb4996b4148e1def7e56ede7eba25e1aeccd926442881c9f694833f049a51b72077c4c03bbe71ee

  • SSDEEP

    3072:K/yG3uBacP7uE27H0zj4VA6PpKQzOvsQs1xGk+tY5IH3ZpT7l0hQ7dA2l07bB5ST:K93wur7HyVqwHUGdqiJpCG90hy

Score
10/10
netwirebotnetdiscoverypersistenceratstealer

Malware Config

Extracted

Family

netwire

C2

91.189.180.197:727

kalakuta.ddns.net:727
Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      c2d308657eccce04ab9e52c363df6e54_JaffaCakes118

    • Size

      235KB

    • MD5

      c2d308657eccce04ab9e52c363df6e54

    • SHA1

      867bd5b11cc8829f65a84b352fad5115c445b45f

    • SHA256

      cbc223f2c31975d75036610291b14193b98438d9e0629a4f9f83b5bf0f55234a

    • SHA512

      3f4b7e2cccb9d5837855db651f01a1b1b480e5474fa35b99ffb4996b4148e1def7e56ede7eba25e1aeccd926442881c9f694833f049a51b72077c4c03bbe71ee

    • SSDEEP

      3072:K/yG3uBacP7uE27H0zj4VA6PpKQzOvsQs1xGk+tY5IH3ZpT7l0hQ7dA2l07bB5ST:K93wur7HyVqwHUGdqiJpCG90hy

    Score
    10/10
    netwirebotnetdiscoverypersistenceratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks