Extracted

• • Target

    acdd91b9109d9941966054c920abed4607eb57d13b0bed263739a09725f384d0

  • Size

    178KB

  • MD5

    a1d75653e4bd80d6a9eeee186e1b1ab8

  • SHA1

    94beecf7b9225c253f8358468e846f3bfc363eb1

  • SHA256

    acdd91b9109d9941966054c920abed4607eb57d13b0bed263739a09725f384d0

  • SHA512

    834fe98451a44103c65dceae07d7221a27108e325225a37e9d9e47a484098c79b4a488e0513ab37b23250df673ea598fcc49a88fd34b4ad2e7499d1d6152351d

  • SSDEEP

    3072:I7VNBmjq8Kmvn6rIVTYC7H2rAalUW4R6rv3p8WStxlQu2VCPwz:I7VzxYnWI6agAalr4UrPp8WStPQu28Y

  Score

  10^/10

  discoveryevasionpersistencenetwirebotnetratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2