Extracted

• • Target

    EMV Writer Reader Software v8.exe

  • Size

    1.3MB

  • MD5

    f368225b07c15a58fc20c022b5d67ac7

  • SHA1

    0b91bffa3098fc586516a08c10a641c0f01a4337

  • SHA256

    e146c7e9223d84f76c59a0979facb49a347bb1b1427df98334a22b348bb624cd

  • SHA512

    678de6e96ba0caf0daf6e00c7da37018cbcb3cf0bd7384e7a1a21e0d23e4a0bda3b42adaae38e037e61c0e53d40db53273b98da305a9149fe69111dea0199fb6

  • SSDEEP

    24576:gRmJk9oQrilOIz+yMxPaknyxaKwdGyR/iOcYs1PtGaGw4o:ZJwoQryTtMxPaksa91RKHbUS

  Score

  10^/10

  netwirebotnetdiscoverypersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2