Extracted

• • Target

    4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40N

  • Size

    178KB

  • MD5

    a012533b4e4ffe2ec1fba8af4d64f7d0

  • SHA1

    6addd503fa50ab9b551ff26cfd44f65d0348e898

  • SHA256

    4d85cd2e60a0c5b4179d6f401c1ee56bfcdfda7a6328caced1732482d5b1ff40

  • SHA512

    f588e81bf477c001995d44d7d17eedca3a7392eb43072679e06b1440f8c9cb9dd1ecf597e536ccf2975fcf9f3d7c481306b3a018194815e6f87bdfd211604301

  • SSDEEP

    3072:I7VNBmjq8Kmvn6rIVTYC7H2rAalUW4R6rv3p8WStxlQu2VCPwe:I7VzxYnWI6agAalr4UrPp8WStPQu28Z

  Score

  10^/10

  netwirebotnetdiscoveryevasionpersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2