MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03dcc84a1b2387ef18e82b9deeaa45da311890d27b3d28d022d43924201b7bcc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 6

Intelligence 6 IOCs YARA 4 File information Comments

SHA256 hash:	03dcc84a1b2387ef18e82b9deeaa45da311890d27b3d28d022d43924201b7bcc
SHA3-384 hash:	53fdfee51f8fbd8c0e4ee8a082bf54b5136a530855b9ed3c2c16fdd60431347561d08ac292f1889909d8a3504f5da7b2
SHA1 hash:	239f0ba4d60c2198c2fc60789decc768a71b375b
MD5 hash:	a7604764a04eb792e896569a9c0a5954
humanhash:	august-nitrogen-stream-island
File name:	DEALER REQUIREMENT.pdf.exe
Download:	download sample
Signature	NetWire Create hunting rule
File size:	780'648 bytes
First seen:	2020-06-26 15:38:29 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	40976bd0dfb9d8835690180f02eb563a (3 x RemcosRAT, 2 x FormBook, 1 x NetWire)
ssdeep	12288:/HDP+feVTP9D8jFUnohgvBsMWwo1fkR3CcYs6z7xpJ1SGSwl:fLVR9gjF8ohgvBfo9kchz1DSwl
Threatray	322 similar samples on MalwareBazaar
TLSH	F0F48E22F2909C37C1332A789D6BB669582ABF112D38AD463FF47D8C5F36341382559B
Reporter	abuse_ch
Tags:	exe MailChannels NetWire nVpn RAT

abuse_ch

Malspam distributing NetWire:

HELO: bisque.elm.relay.mailchannels.net
Sending IP: 23.83.212.18
From: Okopi Amedu <Okopi.Amedu@ng.multichoice.com>
Subject: SUPER DEALER AND BRANDED STORES
Attachment: DEALER REQUIREMENT.pdf.zip (contains "DEALER REQUIREMENT.pdf.exe")

NetWire RAT C2:
indigo22.ddns.net:3478 (79.134.225.69)

Pointing to nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

121

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/14964/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

SecuriteInfo.com.AI.Packer.7BA51BF319.27257.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Creating a file

Launching the default Windows debugger (dwwin.exe)

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/03dcc84a1b2387ef18e82b9deeaa45da311890d27b3d28d022d43924201b7bcc/

Threat name:

Win32.Backdoor.NetWiredRc

Status:

Malicious

First seen:

2020-06-26 15:40:08 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=apomqsq3eod66ghifoo65ksf3iyrregspm6srubc2q4siia3ppga._file

Verdict:

malicious

Label(s):

netwirerc

Result

Malware family:

netwire

Score:

10/10

Tags:

rat persistence botnet stealer family:netwire

Link:

https://tria.ge/reports/200626-swf4c2bkxs/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run entry to start application

Legitimate hosting services abused for malware hosting/C2

Netwire

NetWire RAT payload

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Malicious_BAT_Strings Create hunting rule
Author:	Florian Roth
Description:	Detects a string also used in Netwire RAT auxilliary
Reference:	https://pastebin.com/8qaiyPxs

Rule name:	MAL_unspecified_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects unspecified malware sample
Reference:	Internal Research

Rule name:	netwire Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect netwire in memory
Reference:	internal research

Rule name:	Suspicious_BAT_Strings Create hunting rule
Author:	Florian Roth
Description:	Detects a string also used in Netwire RAT auxilliary
Reference:	https://pastebin.com/8qaiyPxs