netwire

General

Target
fe1a21fd2f2c7385f70ed907ea985707_JaffaCakes118
Size 110KB
Sample240929-jxxtjavgrr
SHA256 f338a70e47e02ffe040eb7d23a3d15ecdb6252412f786c95bad31c0c51f7d2a8
MD5 fe1a21fd2f2c7385f70ed907ea985707
SHA1 30abfcfb656f8dfa304aa40c328bd879e532483a
SHA512 6f55edda96d10d63eba9b1c0ca03f02f74af555e0731fe7b03e5b534ffa5f14654076b5e69bff775281569eef01874dd300c0e9943129617307688c0112bae48
SSDEEP 3072:/i51oD+WU38f5wrEI1cAXBgQRCh+dawWh4eIqfV:6/ojO83I1UEChu1WCejt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

netwire

C2

127.0.0.1:1533

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
spaxxxvbn
lock_executable
false
offline_keylogger
false
password
Password
registry_autorun
false
use_mutex
false

Targets

- Target
  sparrows.exe
- Size 208KB
- SHA256 2e27bf386a514320dc15a2cbce4967a1cb7602dbc2e90865dc19d422776e8063
- MD5 0b7621da72f30a6ce13f51de02bfd098
- SHA1 68c7dc41b82713067c4fde4455339d84e2c39e66
- SHA512 cc9c208c1bfca3ccb6ba6466072414787b9105d13e90d7dcfea0d61de394751c9d9c5f0d9f4d385c98240c188dcd67044d22a3033afc05e5970f2df43bd3ea65
- SSDEEP 3072:bNFviD+WU38n5wrEY13Mz1eGbbrdgMTXOM7B+p:JspO8vY13FGXxge4p
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

netwire botnet discovery rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

NetWire RAT payload

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2