Overview

overview

10

Static

static

10

54cd2f165c...19.exe

windows7-x64

10

54cd2f165c...19.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    fda4d446512690de6db76be57c9f28ed_JaffaCakes118
  • Size 83KB
  • Sample240929-c7lexsxaml
  • SHA256 d3ff8492eb7caa7c1cb22fb6bddc29f44452a12ce5225448dc2d16bc8e2afbf8
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
netwirebotnetdiscoveryratstealer

Malware Config

Extracted

Family

  • netwire

C2

  • crimea-kremlin.duckdns.org:3396

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    Crimea

  • lock_executable

    false

  • mutex

    XgVApLQA

  • offline_keylogger

    false

  • password

    codin2318

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target
      54cd2f165cdc6bc4fcc50fce8da1206b5c1bfedb442d2a000e965019d379a719.exe
    • Size 161KB
    • SHA256 54cd2f165cdc6bc4fcc50fce8da1206b5c1bfedb442d2a000e965019d379a719
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    netwirebotnetdiscoveryratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks