Overview

overview

10

Static

static

Fw_CONFIRM...20.exe

windows7_x64

10

Fw_CONFIRM...20.exe

windows10_x64

10

Resubmissions

29-05-2020 15:48

200529-1srcc11mvs 10

18-05-2020 13:05

200518-5aex7b1s12 5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Fw_CONFIRMATION_OF_BALANCES-AP20.exe

  • Size

    476KB

  • Sample

    200529-1srcc11mvs

  • MD5

    8a522b7dfd76a91312ea31b4e827b4a0

  • SHA1

    0754d2176df167f3e46d397f87ca3834cd89dee7

  • SHA256

    77642de174198cae37f2b0ce29eb087f138800df44a79bd0e589962e9fc64e36

  • SHA512

    1c82a4d893cfde8eedd9141d8ee83cccb752e9ccf1b89cbf5d3d9c9c655e1440548784eb8af82775b0930fdce137335f4bf084f63643052fa0523791bc2192b0

Score
10/10
netwirebotnetratstealer

Malware Config

Targets

    • Target

      Fw_CONFIRMATION_OF_BALANCES-AP20.exe

    • Size

      476KB

    • MD5

      8a522b7dfd76a91312ea31b4e827b4a0

    • SHA1

      0754d2176df167f3e46d397f87ca3834cd89dee7

    • SHA256

      77642de174198cae37f2b0ce29eb087f138800df44a79bd0e589962e9fc64e36

    • SHA512

      1c82a4d893cfde8eedd9141d8ee83cccb752e9ccf1b89cbf5d3d9c9c655e1440548784eb8af82775b0930fdce137335f4bf084f63643052fa0523791bc2192b0

    Score
    10/10
    ratbotnetstealernetwire

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks