Extracted

• • Target

    e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebbN.exe

  • Size

    178KB

  • MD5

    e569a1b41541d2e7a1bd0ac55d1826a0

  • SHA1

    f7657cc8993c94ffc86174f0343f530040058d8b

  • SHA256

    e71c2ff6a3436c7db33d2c5449d7a313925911b06d958337e6b9fb241ce97ebb

  • SHA512

    0cf26d15a30fcb320da15f12ee925bdd04f53a3ae3ce3db19fb458c32a7e42417787d28763fe83dbc4e025fa8afd1fbef9e81bd64699d50b1a1e29c29123d218

  • SSDEEP

    3072:I7VNBmjq8Kmvn6rIVTYC7H2rAalUW4R6rv3p8WStxlQu2VCPw0:I7VzxYnWI6agAalr4UrPp8WStPQu28J

  Score

  10^/10

  netwirebotnetdiscoveryevasionpersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Netwire family

    netwire

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2