netwire

General

Target

RNSM00401.7z
Size

15.3MB
Sample

241030-1tbwbstjhj
MD5

82ba3c8e635d5e3e743049d29eb92a72
SHA1

ad4f048b3e0cfd4284362f3d940ecc9008b68fad
SHA256

f128b85f26a5fae2bfa3cba5ea746d561a87d53f7713aee985fc68c8b4905895
SHA512

ad6c87b7e8a9baa6b9c934186424eee6e366aed016651a344cdcc66e36ff28c017cb0ecca1f9bc5d1174cace2eb6a665205a081ad9c90feffd7f758658a8bfe3
SSDEEP

393216:P9DZi2W047ho8UZzx+F8edI0MK+bG8nYwDFXlDGn:PPi2WZNo8W+F8eJMKb8B1DM

Score

10^/10

Malware Config

Extracted

Family

netwire

C2

uploadp3p.publicvm.com:3361

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
NeW-%Rand%
install_path
%AppData%\Install\sisHost.exe
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
kHnMFtjY
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
true

Extracted

Path

C:\Program Files\Common Files\microsoft shared\ClickToRun\Read_Me.txt

Ransom Note

Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://alcx6zctcmhmn3kx.onion/?FHULIFMO 5. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. Alternate communication channel here: http://helpqvrg3cc5mvb3.onion/

URLs

http://alcx6zctcmhmn3kx.onion/?FHULIFMO

http://helpqvrg3cc5mvb3.onion/

Targets

- Target
  
  RNSM00401.7z
- Size
  
  15.3MB
- MD5
  
  82ba3c8e635d5e3e743049d29eb92a72
- SHA1
  
  ad4f048b3e0cfd4284362f3d940ecc9008b68fad
- SHA256
  
  f128b85f26a5fae2bfa3cba5ea746d561a87d53f7713aee985fc68c8b4905895
- SHA512
  
  ad6c87b7e8a9baa6b9c934186424eee6e366aed016651a344cdcc66e36ff28c017cb0ecca1f9bc5d1174cace2eb6a665205a081ad9c90feffd7f758658a8bfe3
- SSDEEP
  
  393216:P9DZi2W047ho8UZzx+F8edI0MK+bG8nYwDFXlDGn:PPi2WZNo8W+F8eJMKb8B1DM
Score

10^/10

netwire botnet discovery ransomware rat stealer upx
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Netwire family
  netwire
- Executes dropped EXE
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1