netwire | 22147dc4db0fbb2e9dfa8632f2a641c3510c208da9b821cde79a8e509838e5c5 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

PAYMENT-IN...EL.exe

windows7-x64

PAYMENT-IN...EL.exe

windows10-2004-x64

Sharing

General

Target

df9a54881d2ddaf302ed481e7fc7f5a1_JaffaCakes118
Size

158KB
Sample

241211-db4gasxlcm
MD5

df9a54881d2ddaf302ed481e7fc7f5a1
SHA1

b00d24913076bfc4e8f545eb20356ea6330ab8dd
SHA256

22147dc4db0fbb2e9dfa8632f2a641c3510c208da9b821cde79a8e509838e5c5
SHA512

94aea410e1c32e6c286a4f16ffd6ab0d96af90edef951917deb990c105a553ed9cae4af3eabaf8dd58a82504f211a4bb0134c7ef9c96986c1dcfd1a4fe0a5b05
SSDEEP

3072:SA5umrT50bT3iwP8G7Zhn4ENoC8NWtVBGqJnFs51Z/s8OUyMhGiWxoLgQj:SA9Sb7ioBb4uR2WtLS1Z/s8O28xoj

Score

10^/10

netwire botnet discovery rat stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

PAYMENT-INVOICE-OVERDUE98878787-EXEL.exe

Resource

win7-20240729-en

netwire botnet discovery rat stealer

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

PAYMENT-INVOICE-OVERDUE98878787-EXEL.exe

Resource

win10v2004-20241007-en

netwire botnet discovery rat stealer

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Extracted

Family

netwire

C2

okenwamothermary.duckdns.org:1104

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
HostId-%Rand%
keylogger_dir
%AppData%\Logs\
lock_executable
false
offline_keylogger
true
password
Password
registry_autorun
false
use_mutex
false

Targets

- Target
  
  PAYMENT-INVOICE-OVERDUE98878787-EXEL.exe
- Size
  
  318KB
- MD5
  
  d1fab92d9a0b56af8b93dcad4a8ebe35
- SHA1
  
  829796e4d2bbc09627eb498e61d6e48daf273095
- SHA256
  
  a42fdf3685f82a662136a36099ba05ef38d2282fac999ce29d4dc183f8bfb01a
- SHA512
  
  1411c30ef43a5a4de232374057eeec6e7739e32f824535051dac1faf5a9971fcbb9467959e0fb8b134ec8baea98079f60d83da29c145396c5fbb1460d29d0cea
- SSDEEP
  
  6144:Ez4q0llllllllllJTPFSoPZsesGA14bFAI1uWv7CWwPaAF:EXQTPQoBsesGycF1Pv7wPaAF
Score

10^/10

netwire botnet discovery rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Netwire family
  netwire
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

netwirebotnetdiscoveryratstealer

behavioral2

netwirebotnetdiscoveryratstealer

© 2018-2025

Terms | Privacy

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.