netwire

General

Target

JaffaCakes118_c03814b0ef1ae37561097cf94248c49e
Size

404KB
Sample

250105-14r1asxpby
MD5

c03814b0ef1ae37561097cf94248c49e
SHA1

7003dadb3576967c9b8a4a5c97976f004443b975
SHA256

29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7
SHA512

327cbafd0df5a52af396ba5fe49349d99e49ef61b5b4ab7f03fe616dae9db644bc2d9c21c28e1a5b758ed9d6441798be39ac5bfa37284e0a254d50847575edcd
SSDEEP

6144:Tn77n8zu2DqpZUBDc2edbpIqAUwWIZwI64Q3dCw2BtBZ:H7nqArILUvIOMw

Score

10^/10

Malware Config

Extracted

Family

netwire

C2

globalpersonaldns.ddns.net:54984

personalpractice1.hopto.org:54984

Attributes

activex_autorun
false
copy_executable
false
delete_original
false
host_id
clients
keylogger_dir
%AppData%\Logs\
lock_executable
false
mutex
vQSrxiLN
offline_keylogger
true
password
checkmate123
registry_autorun
false
use_mutex
true

Targets

- Target
  
  JaffaCakes118_c03814b0ef1ae37561097cf94248c49e
- Size
  
  404KB
- MD5
  
  c03814b0ef1ae37561097cf94248c49e
- SHA1
  
  7003dadb3576967c9b8a4a5c97976f004443b975
- SHA256
  
  29926ffc10b3317f17b31a895d82e8ee854524c6e159f048807c1a56bd95e1c7
- SHA512
  
  327cbafd0df5a52af396ba5fe49349d99e49ef61b5b4ab7f03fe616dae9db644bc2d9c21c28e1a5b758ed9d6441798be39ac5bfa37284e0a254d50847575edcd
- SSDEEP
  
  6144:Tn77n8zu2DqpZUBDc2edbpIqAUwWIZwI64Q3dCw2BtBZ:H7nqArILUvIOMw
Score

10^/10

netwire botnet discovery rat stealer
- NetWire RAT payload
  rat
- Netwire
  Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
  botnet stealer netwire
- Netwire family
  netwire
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

NetWire RAT payload

Netwire family

Drops startup file

Executes dropped EXE

Loads dropped DLL

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2