Overview

overview

10

Static

static

3

99693f2f6c...18.exe

windows7-x64

10

99693f2f6c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99693f2f6c85421734381a0957f5e382_JaffaCakes118

  • Size

    534KB

  • Sample

    241125-fvjx4szpey

  • MD5

    99693f2f6c85421734381a0957f5e382

  • SHA1

    95a8aa1c0c0b3fc775ae45cc34f5350309c77a8f

  • SHA256

    bdf2ac2fd9106e36b071409e48ba9c1996c4b987b6d28e6baf70046316d27c00

  • SHA512

    3d8a0829c7c5c0cc14c58f62ac9bc424c8e5d4331d863c155f6965365cb737ad932feea3897db5cc78d251d2bd4be6f2d9faa05e779b8afae6d98d0e366d04c7

  • SSDEEP

    12288:LT/QcVoZt9IFiohrl+N8+kR1AK205UbtCmJi2q2kpLa:Lc+hBr1AKB5UpJq26

Score
10/10
netwirebotnetdiscoveryratstealer

Malware Config

Extracted

Family

netwire

C2

193.23.127.96:5004

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    FUDS

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    false

Targets

    • Target

      99693f2f6c85421734381a0957f5e382_JaffaCakes118

    • Size

      534KB

    • MD5

      99693f2f6c85421734381a0957f5e382

    • SHA1

      95a8aa1c0c0b3fc775ae45cc34f5350309c77a8f

    • SHA256

      bdf2ac2fd9106e36b071409e48ba9c1996c4b987b6d28e6baf70046316d27c00

    • SHA512

      3d8a0829c7c5c0cc14c58f62ac9bc424c8e5d4331d863c155f6965365cb737ad932feea3897db5cc78d251d2bd4be6f2d9faa05e779b8afae6d98d0e366d04c7

    • SSDEEP

      12288:LT/QcVoZt9IFiohrl+N8+kR1AK205UbtCmJi2q2kpLa:Lc+hBr1AKB5UpJq26

    Score
    10/10
    netwirebotnetdiscoveryratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Netwire family

      netwire

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks