Extracted

• • Target

    3b41fb9385c0ac13fc08f3fda2098ac0N.exe

  • Size

    118KB

  • MD5

    3b41fb9385c0ac13fc08f3fda2098ac0

  • SHA1

    979c54b5e2d8afec33bc69ffb7a35a81a14264c8

  • SHA256

    878d2d7e6bc21b888be0c88716d0457fbb224f3d27263be509180aaf8aa4f611

  • SHA512

    d54d1109c7689c2867d4c8bb41667005717c36404e094316f9dc35a7810561867588d10f5da303656e087e76de5e0f9996b47c24f6f1b2e8128d36bb5ae280e8

  • SSDEEP

    3072:M+z7JXnrdFzp886+RMPy5fWMwdWRgjnahKoutjKI7ehMx:rz75nrz286+RMaLVRgjahKoS

  Score

  10^/10

  netwirebotnetdiscoveryratstealerupxpersistence

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2