Overview

overview

10

Static

static

3

5a8d72946b...77.exe

windows7-x64

10

5a8d72946b...77.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d15142a0a1c59537442b00f66882e45fd824cedeae2e4be53f1d2b7a00246d4c.zip

  • Size

    214KB

  • Sample

    250327-k5dajaztgw

  • MD5

    db10bfe1419c2a4e6545bf1594f0bfc7

  • SHA1

    072cd3663f231208f2bbb806d6cc5a5642dc2361

  • SHA256

    d15142a0a1c59537442b00f66882e45fd824cedeae2e4be53f1d2b7a00246d4c

  • SHA512

    d0d274739d653b40adc650d514c56adc19bd1b280d883e58e409303819512141f738a136cb5ce3893303367fcc1069056472a7bd3d8ce3fc579397a8f290cee3

  • SSDEEP

    6144:Tz/8NEQVSFohTl8UwuRTDVfbFurILtxGN5NFW:Tz/80ojwe1cq+Nc

Score
10/10
netwirebotnetdefense_evasiondiscoveryratstealer

Malware Config

Extracted

Family

netwire

C2

deesesejh45.hopto.org:3360

Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    HostId-%Rand%

  • keylogger_dir

    %AppData%\Logs\

  • lock_executable

    false

  • mutex

    oPXDHtoU

  • offline_keylogger

    true

  • password

    Password

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      5a8d72946b1e08785bba3e067a64cdf3735b46834d4edf4d87d1916bd416a777.exe

    • Size

      865KB

    • MD5

      427e8565cb7c4bbff0ff3c07205f517a

    • SHA1

      833a20dd03e1e5aed3d4284fde3d6a8208a97c88

    • SHA256

      5a8d72946b1e08785bba3e067a64cdf3735b46834d4edf4d87d1916bd416a777

    • SHA512

      59240e826ed5c265cc06f89b4826fc0de56e71ae46e19657b88976e89290c01a7320448e5aa82124fcaa88c534d99cee941cc986f57954da6dffc75faadebfeb

    • SSDEEP

      12288:tWEauBVmKa8mdBBh4bgSZuG2U6uKEmaN0:UEaXB3WuIhN

    Score
    10/10
    netwirebotnetdefense_evasiondiscoveryratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Netwire family

      netwire

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks