Extracted

• • Target

    540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9N

  • Size

    178KB

  • MD5

    fdd19703be4eef41ca88975b29887460

  • SHA1

    ee92d74428a9b60aab301ecbe84247a4fa3987f6

  • SHA256

    540236b76967933bb87e0ef367305f2e56dac966370d3989203e2faa70bf32d9

  • SHA512

    f91c4a2d09622ff0b26c7c8e1bb0e3316b407978a6c4f00fe9f828239d8232fee6010f67aa386b67f394528bcb71043d9da04e7659b0bce8886973051c15c92e

  • SSDEEP

    3072:I7VNBmjq8Kmvn6rIVTYC7H2rAalUW4R6rv3p8WStxlQu2VCPwe:I7VzxYnWI6agAalr4UrPp8WStPQu28/

  Score

  10^/10

  netwirebotnetdiscoveryevasionpersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2