netwire

General

Target

dc794c6baef5fa590421ac67e3d08a4b_JaffaCakes118
Size

2.4MB
Sample

240912-seg5sszgmm
MD5

dc794c6baef5fa590421ac67e3d08a4b
SHA1

3362ee2afdb1cf40830a8e3e3ec2dde1eb0887a0
SHA256

d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe
SHA512

08133ba467a25450a303323ddc21ac0697a75bf42ee80994dcc89161c1d7b03e3a9960c782d2126522076c115404492cf7490e5cbe979e1c2ba8baa895227cf6
SSDEEP

49152:2JGhVJmzCDq35LO3mIp07KtjgRk0oqRuwSCFVPB9ZhhqDF8xLt9QQfBcWqeR+jl2:2gjLW8OjQ1a7

Score

10^/10

Malware Config

Extracted

Family

netwire

C2

venezia-pl.myq-see.com:3737

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
February-2021
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
bQkxKHhm
offline_keylogger
true
password
ALANKA121
registry_autorun
false
use_mutex
true

Targets

- Target
  
  dc794c6baef5fa590421ac67e3d08a4b_JaffaCakes118
- Size
  
  2.4MB
- MD5
  
  dc794c6baef5fa590421ac67e3d08a4b
- SHA1
  
  3362ee2afdb1cf40830a8e3e3ec2dde1eb0887a0
- SHA256
  
  d736c5b2ae27af1aee10c2dbdecfdc42dde2addb52b2994f3e1d57c7bc97fbfe
- SHA512
  
  08133ba467a25450a303323ddc21ac0697a75bf42ee80994dcc89161c1d7b03e3a9960c782d2126522076c115404492cf7490e5cbe979e1c2ba8baa895227cf6
- SSDEEP
  
  49152:2JGhVJmzCDq35LO3mIp07KtjgRk0oqRuwSCFVPB9ZhhqDF8xLt9QQfBcWqeR+jl2:2gjLW8OjQ1a7
Score

10^/10

netwire botnet discovery execution rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Beds Protector Packer
  Detects Beds Protector packer used to load .NET malware.
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

NetWire RAT payload

Beds Protector Packer

Drops startup file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2