MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ca80f61a8161466cf3d95834691dc42ec0a08caa62b53f78b93d98810ff6115. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	0ca80f61a8161466cf3d95834691dc42ec0a08caa62b53f78b93d98810ff6115
SHA3-384 hash:	88b043dfff9e15da57c21a280b15b29e762eecb3158980a3d00f47811e477c0611c1dd3a3779f1cdc2ea5697bab5d9e4
SHA1 hash:	89fb070d73c3b60b675ddda7492a238f800d8747
MD5 hash:	6998df0aeeb0a1583e6236b1ee22fb73
humanhash:	apart-pasta-august-spring
File name:	6998df0aeeb0a1583e6236b1ee22fb73.exe
Download:	download sample
Signature	NetWire Create hunting rule
File size:	81'920 bytes
First seen:	2020-06-01 13:22:28 UTC
Last seen:	2020-06-03 14:35:58 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	4ff07344affacc19e934fc80ccb14b73 (1 x NetWire)
ssdeep	768:AFhc7416N8lBR2zVClAZ1gyqsoYB+aBqh+m47Geh4Vkxrva+XbWY6L7aLJR+m4o:uFO8lLz9sVvBa+PGeC8aaB6L7aNR+
Threatray	863 similar samples on MalwareBazaar
TLSH	77835B27EA18AA12E16146702C6BC7FE2F657C0C89821F8F354E6E5B7B313725C6D60D
Reporter	abuse_ch
Tags:	exe NetWire RAT

Intelligence

File Origin

# of uploads :

# of downloads :

101

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.Siggen9.51143.26573.20232.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Ditertag

Status:

Malicious

First seen:

2020-06-01 13:35:39 UTC

AV detection:

33 of 48 (68.75%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bsua6ynicykgntz5swbuneo4ilwaucgkuyvvh54lspmyqeh7mekq._file

Verdict:

malicious

Label(s):

guloader

Result

Malware family:

n/a

Score:

6/10

Tags:

persistence

Link:

https://tria.ge/reports/201109-yx942prdqe/

Behaviour

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Adds Run key to start application

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_asyncrat_j1 Create hunting rule
Author:	Johannes Bader @viql
Description:	detects AsyncRAT

Rule name:	win_netwire_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator