Extracted

• • Target

    b5a6a7bb51594561825295ee7fdee1a1e4a693030f35b5894200f5e5140aeec9N

  • Size

    178KB

  • MD5

    b0674e788aa2f6027e1331ae68821110

  • SHA1

    cc98d49ff6628e81569a613f83f1073044650bb5

  • SHA256

    b5a6a7bb51594561825295ee7fdee1a1e4a693030f35b5894200f5e5140aeec9

  • SHA512

    1a058cd3e35d70c778ed548101d96f8f71310f4b7a78bb9b70594bc8271eda849469a2c488e769006a2432b3a6ca39c00d4854324fad3922be064251a31690ee

  • SSDEEP

    3072:I7VNBmjq8Kmvn6rIVTYC7H2rAalUW4R6rv3p8WStxlQu2VCPwp:I7VzxYnWI6agAalr4UrPp8WStPQu28K

  Score

  10^/10

  netwirebotnetdiscoveryevasionpersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2