MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c303fb93eba5623184f5bfb8fefbea2458e25ead795e6d5c5d5e78e921c6490e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c303fb93eba5623184f5bfb8fefbea2458e25ead795e6d5c5d5e78e921c6490e
SHA3-384 hash: ea7dc989e2e6df507350ae6b0dfb99d5b8b3ea3d202640a956e57e117ece6396156f0808e69c3aaed63490fcd4af1b69
SHA1 hash: 9cd8e279dff02db6ffb9199cf6cb4ff5fc07cc37
MD5 hash: c4dc14e8754c36300ae98fa8b4369a40
humanhash: quebec-rugby-hotel-delta
File name:009888389998789290000-pdf.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:897'536 bytes
First seen:2020-05-06 12:24:40 UTC
Last seen:2020-05-06 13:02:37 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 09b36f599f170a10f41ac83328a324cf (4 x AgentTesla, 1 x NetWire)
ssdeep 24576:OR6DfxrufD3oCy4blTlJHUelHV3zdplVnHc5ESJ:OKxeXbVhzHc5E
Threatray 5'096 similar samples on MalwareBazaar
TLSH 51159E62F5A5D433D2323A3C8D5BA365E82BBE102D2864767BE50E884F3D64235391F7
Reporter jarumlus
Tags:NetWire

Intelligence

File Origin
# of uploads :
2
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 15:40:00 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ymb7xe7luvrddbhvx64p567kermoexvnpfpg2xc5lz4osiogjeha._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
040e2a7b73768aea00579bd04fa834afa4b33966459c4c9d4c4cddfb7cffe8c0
NetWire
1c7388bfdfb41e34dc95423b351d3b18d737889d9f8648da0ce24048d6e2f495
NetWire
1d24189fffd0bdcb0395a3670721f29f37d08bd80565471db28d45ac36b2cbc9
NetWire
1d26a5cf8e279ddaa3ad924224219b550f7d431e8d6adbcb7bd36c01d4eae2d9
NetWire
2fdb0d7b083751a10db872738e974f869b99f2ca21891a5fb96bc9440f827ffb
NetWire
3f256c15a96f8f556978318a55308e3ef709f29d93a18d0c2d262f305477cfb2
NetWire
490a783bc399cb6dd9b64ecc8d0f909830fe1a351d18f148493fcdf6eefb52cd
NetWire
5ef5d6bc0c7af14274c71cdc4377785a79143786556262137f496a94170ac56b
NetWire
811b6950ba9561169b22ccfc12daf0fc57f26a910272f56288bd0d7c10da5c15
NetWire
bca55e158b112f5d776f4402d48cdfaf5ae42b4d8f2e063ac69ba2405bfcc60a
NetWire
+ 5'086 additional samples on MalwareBazaar
Result
Malware family:
formbook
Create hunting rule
Score:
  10/10
Tags:
family:formbook rat spyware stealer trojan
Link:
https://tria.ge/reports/201109-t1p5t4cwa6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of UnmapMainImage
Suspicious use of SetThreadContext
Deletes itself
Formbook Payload
Formbook
Malware Config
C2 Extraction:
http://www.nyoxibwer.com/hm2/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

Executable exe c303fb93eba5623184f5bfb8fefbea2458e25ead795e6d5c5d5e78e921c6490e

(this sample)

NetWire

zip fe272bc2bdf59b23e1ff41b5aba9243faa18a92d3a3198924ffeb167e1a4236a

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fe272bc2bdf59b23e1ff41b5aba9243faa18a92d3a3198924ffeb167e1a4236a
  
Dropping
MD5 3aad61111eeb4cc361b63a755fddba59

Comments