Extracted

• • Target

    ea0debd4751243fe714b3fac95f7c62eb1c1dccd481ce8bd1eb2c789eeabf8dc.exe

  • Size

    178KB

  • MD5

    02184b64e5bf2458841e640b4401ed0e

  • SHA1

    4ab573a80d6f315b61b3b0fe9bcc5ba3aed68703

  • SHA256

    ea0debd4751243fe714b3fac95f7c62eb1c1dccd481ce8bd1eb2c789eeabf8dc

  • SHA512

    90c4c10cbb7483c36bc7512320f0d4c088f69efb2a1d043c08e54683e89a9f8a70194cd7b2a78881d3ef2c1c47863c587b39a584272ba4f5753a26873609d90c

  • SSDEEP

    3072:I7VNBmjq8Kmvn6rIVTYC7H2rAalUW4R6rv3p8WStxlQu2VCPwM:I7VzxYnWI6agAalr4UrPp8WStPQu28b

  Score

  10^/10

  netwirebotnetdiscoveryevasionpersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Netwire family

    netwire

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2