Extracted

• • Target

    21078001f9922cf0dd159a9b841959a0fe0e5267f941c3b5ee3cb56f83a542df

  • Size

    178KB

  • MD5

    33529338b08fefb84dc9ce5416fab27b

  • SHA1

    6adbe2f716c2417e3a3d5a238c1ee70afd14d10b

  • SHA256

    21078001f9922cf0dd159a9b841959a0fe0e5267f941c3b5ee3cb56f83a542df

  • SHA512

    381bea13ddcf77f942ccf45fee495698319a060b067edc54ce534bd97084eca90b0b9c3c42432d1d8202425cf481ace64ff40637a9b77e2fe12f911b4d1be1a9

  • SSDEEP

    3072:I7VNBmjq8Kmvn6rIVTYC7H2rAalUW4R6rv3p8WStxlQu2VCPw2:I7VzxYnWI6agAalr4UrPp8WStPQu28F

  Score

  10^/10

  netwirebotnetdiscoveryevasionpersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2