MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0538554b73f98f395950af81f30e4fc99407e991babdce510bb61f9f9b56f23e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0538554b73f98f395950af81f30e4fc99407e991babdce510bb61f9f9b56f23e
SHA3-384 hash: c7cca43737131942a72d919d60e3c9f5e088446656c2805c5dad0c1f713151022dd5769ea93fb5d4ebf388ecda60758b
SHA1 hash: 2d1689adad9b7f01a6068c9eacb609f079d9e071
MD5 hash: 2e0f442ccc270d8f0763a9f4126fd125
humanhash: carbon-helium-kitten-eighteen
File name:nuv.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:2'252'576 bytes
First seen:2020-11-04 20:16:05 UTC
Last seen:2020-11-04 21:45:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash a1047fec984fa2dbd6fba5a7d4708797 (1 x NetWire)
ssdeep 49152:KyieEjMQSdMNCgGI6hE/B2SyFUpkH4giXPbshuwmitOrSzMWtP:KleEjQGCgGIEi8SyZ4giUmq
Threatray 279 similar samples on MalwareBazaar
TLSH 6FA5AE12B641857FEAD22374F6FE93790A796E10033984D793D07F9928326D26B3E2C5
Reporter James_inthe_box
Tags:exe NetWire

Code Signing Certificate

Organisation:DigiCert Assured ID Root CA
Issuer:DigiCert Assured ID Root CA
Algorithm:sha1WithRSAEncryption
Valid from:Nov 10 00:00:00 2006 GMT
Valid to:Nov 10 00:00:00 2031 GMT
Serial number: 0CE7E0E517D846FE8FE560FC1BF03039
Intelligence: 22 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 3E9099B5015E8F486C00BCEA9D111EE721FABA355A89BCF1DF69561E3DC6325C
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
147
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Netwire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/83008/
Detection(s):
SecuriteInfo.com.Generic.mg.2e0f442ccc270d8f.6479.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
DNS request
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Sending a TCP request to an infection source
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/520696
Signature
Contains functionality to log keystrokes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (creates a PE file in dynamic memory)
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Sigma detected: NetWire
Uses dynamic DNS services
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0538554b73f98f395950af81f30e4fc99407e991babdce510bb61f9f9b56f23e/
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2020-11-04 20:14:49 UTC
File Type:
PE (Exe)
Extracted files:
20
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=au4fks3t7ghtswkqv6a7gdspzgkap2mrxk644uilwypz7g2w6i7a._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
0c34d4763fc968ccbe9f33dec2ae9e3e132a61b40ffc93cc22f337a0758c0279
NetWire
4e52cdd00c05814d563b70e3271df67fb530ec90dca084a4f1b4d3f539e58061
NetWire
573f11821c72786131d82bcdb3744b83d01615c25489f4cf2c46181ae6143226
NetWire
8f9f4cc3a0403e5c2522726849e8a2033d72fc7f36b2317bc9fb86808c1693ec
NetWire
b0a98ae8b1dadc3b181f6252abef59940ceeb5019cd4ae2f0feadb0a520063cd
NetWire
b16b3d99441f078e081e2ac0a8f0121ce4dab264bf434e353d1e00a57e54d3aa
NetWire
b6f5a289ab47b790c1bc57a5a3b35871fc968da66ebb3fdd7669de18c2ba3dd5
NetWire
c1ffaaa3fad1741534ca46e6eb19dbafebc46932eecccef600f69a615d8e57ea
NetWire
df2688f6f88ea0e66b46d856e514adf25f8456cb4e45c849233799e17b1171e3
NetWire
f09dc0b3275b4c1e3a616911805011c2871af1407599493dc980b6987cb313eb
NetWire
+ 269 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet persistence stealer
Link:
https://tria.ge/reports/201104-gd2k1n7jhe/
Behaviour
Suspicious use of WriteProcessMemory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Netwire
Unpacked files
SH256 hash:
8b25dd5d1be6cccc269d760de85aa3a5a0c1f927af13c5cc04a9055ef5bc032f
MD5 hash:
2bfc62284106fed2b2d74d06419ab22b
SHA1 hash:
6592b8966d247cdc19da408baaaac57ce8af78c3
Detections:
win_netwire_g1
Create hunting rule
win_netwire_auto
Create hunting rule
Link:
https://www.unpac.me/results/28ab1903-717f-4818-b461-369381e57924/
SH256 hash:
0538554b73f98f395950af81f30e4fc99407e991babdce510bb61f9f9b56f23e
MD5 hash:
2e0f442ccc270d8f0763a9f4126fd125
SHA1 hash:
2d1689adad9b7f01a6068c9eacb609f079d9e071
Link:
https://www.unpac.me/results/28ab1903-717f-4818-b461-369381e57924/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:Steam_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Steam in files like avemaria
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/83008/

Comments