Extracted

• • Target

    ea32c3c39c8c3f83e95916262d37b5aa49c920a9356dcebfa639b8391413ae9a

  • Size

    808KB

  • MD5

    a2609cffa6b57d22ffbe342013f59847

  • SHA1

    9dd92ebe68c7b149cb09edebf7587adf7ee5a4e5

  • SHA256

    ea32c3c39c8c3f83e95916262d37b5aa49c920a9356dcebfa639b8391413ae9a

  • SHA512

    adb6409708564e0e4070e22c2f0786861f756721f6e2defb15e3e7dc4547336d5d7f70b347a3c0f105acae0ae312b08470154fe0ea09ee5a912cd1d76a4d2b9f

  • SSDEEP

    12288:SzE+eQ2iNEF75euLUDYGbOwUjJLN4DXwEBYHofeVs06RBteoqpo1cxWY4/:ZQ16Z5fSYv5vsXwVHofdYoqpo2

  Score

  10^/10

  netwirebotnetdiscoveryexecutionratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Netwire family

    netwire

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2