Extracted

• • Target

    12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6N.exe

  • Size

    385KB

  • MD5

    512281e92d3b3b17ebd7d13adcab06d0

  • SHA1

    65a5e333e325afa8ee05b3015fbfb89f5efdcd51

  • SHA256

    12bc63508f52ba13963e59a56f75d5554fb1aa2b973b16d5db520a011df135e6

  • SHA512

    ab03b5061bcaf7b536ce26f35b25608f92b0033802679cf4fe46fca543ff97f2e5117a0eb0d35e5c6ef168be345bf04ef6e284d9878bbb4f6ad14658b128362c

  • SSDEEP

    6144:QSUomEUi3+sMZ3xEYIrQ3XF+v/Tt0jwVw2Zurr55CUoxUaxL:BUomEFRu3xEPEU/Xw2mr+qm

  Score

  10^/10

  netwirebotnetdiscoverypersistenceratstealer

  • NetWire RAT payload

    rat

  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

    botnetstealernetwire

  • Netwire family

    netwire

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2