Extracted

• • Target

    40a8519a5f2aefa00980f01eea59a08b564555137e515ac6ebd9d6c1a35eee18.exe

  • Size

    172KB

  • MD5

    2e36ffd2e61f106b681fb563e75e295f

  • SHA1

    8819efb80b1d122974b7a871d13e57eb50145fc3

  • SHA256

    40a8519a5f2aefa00980f01eea59a08b564555137e515ac6ebd9d6c1a35eee18

  • SHA512

    3be2390629471f099d7a381eef12ad76293ba10bacd451d97c98e5efc5c1eb87bd9e33f6b38cbfb5ac130d2456ce727e12307fd056f7ec2475d2f0cc5226789b

  • SSDEEP

    3072:56RrEikYA0QdTh532O8QXJlx3er+jL7ScA96TElZIajM/naFhNlUw4WOXZfa:5d0Ih532Kd3zjL7S1kEl7jyaFJmu

  Score

  10^/10

  netwirebotnetdiscoveryratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Netwire family

    netwire

  • Drops startup file

  • Suspicious use of SetThreadContext

  behavioral1behavioral2