Overview

overview

10

Static

static

3

a8fb76da4c...18.exe

windows7-x64

10

a8fb76da4c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a8fb76da4ceb92ca35ad05469fc1bdd0_JaffaCakes118

  • Size

    905KB

  • Sample

    240614-lht57sycln

  • MD5

    a8fb76da4ceb92ca35ad05469fc1bdd0

  • SHA1

    6d62b52b056cc4b7aed9ca7252f3a9277035f367

  • SHA256

    ad2934ee9f9824364d86f177709c811fe1e82072b23e9b40151f5be28fb5e435

  • SHA512

    16c65cd81dafa1232a9d8c1496d8299838e637b4417dc65c1e4d3df88e8fea449c652f28a82e551d70e706cdc9f5b8668a29b4e375862476777a0fc59d00c7ac

  • SSDEEP

    24576:SF8p1dpDnlSGs2NMX5/1ork449TrYx2j:SupRnle8M3ort49T5

Score
10/10
netwirebotnetratstealer

Malware Config

Extracted

Family

netwire

C2

n1.procdata.xyz:7408

hotta.ntdll.top:7408
Attributes
  • activex_autorun

    false

  • copy_executable

    false

  • delete_original

    false

  • host_id

    n1-%Rand%

  • keylogger_dir

    %AppData%\ProcShld\Data\

  • lock_executable

    false

  • mutex

    RdTJWgKC

  • offline_keylogger

    true

  • password

    808081ab

  • registry_autorun

    false

  • use_mutex

    true

Targets

    • Target

      a8fb76da4ceb92ca35ad05469fc1bdd0_JaffaCakes118

    • Size

      905KB

    • MD5

      a8fb76da4ceb92ca35ad05469fc1bdd0

    • SHA1

      6d62b52b056cc4b7aed9ca7252f3a9277035f367

    • SHA256

      ad2934ee9f9824364d86f177709c811fe1e82072b23e9b40151f5be28fb5e435

    • SHA512

      16c65cd81dafa1232a9d8c1496d8299838e637b4417dc65c1e4d3df88e8fea449c652f28a82e551d70e706cdc9f5b8668a29b4e375862476777a0fc59d00c7ac

    • SSDEEP

      24576:SF8p1dpDnlSGs2NMX5/1ork449TrYx2j:SupRnle8M3ort49T5

    Score
    10/10
    netwirebotnetratstealer

    • NetWire RAT payload

      rat

    • Netwire

      Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

      botnetstealernetwire

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks