MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 11c18ce1eeb123128d2782cabd4bbaa2a7ae8b48dcb13a1e5b43883e6202ee59. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 11c18ce1eeb123128d2782cabd4bbaa2a7ae8b48dcb13a1e5b43883e6202ee59
SHA3-384 hash: f065831cfe62fef00177d20bb0cb9a87e62910a64f31396abeabf691735de0679c1a04fbc9b7caea0e95d8a50fff9d1a
SHA1 hash: 36065333473fa55af73d8f84224640185cbeded3
MD5 hash: c73c1edd3a88792376e3d9fa2f81a5d5
humanhash: stairway-aspen-march-lima
File name:c73c1edd3a88792376e3d9fa2f81a5d5.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:505'344 bytes
First seen:2020-10-07 10:37:22 UTC
Last seen:2020-10-07 12:24:23 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep 12288:erAjfTy0z00WYahnhgpj+Y5/XpXNCfT1rq:erAjb14bZphgpjvCfT1
Threatray 465 similar samples on MalwareBazaar
TLSH 39B4B54FBA442CADC553FCF3BC184E506134D91C238E86163219B36AB9BA75D7A931E3
Reporter abuse_ch
Tags:exe NetWire RAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
224
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Netwire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/68883/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Launching a process
Creating a file
Creating a window
DNS request
Sending a TCP request to an infection source
Enabling autorun by creating a file
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/483984
Signature
Adds a directory exclusion to Windows Defender
Contains functionality to steal Chrome passwords or cookies
Creates an undocumented autostart registry key
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NetWire
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
netwire
Create hunting rule
Link:
https://mwdb.cert.pl/sample/11c18ce1eeb123128d2782cabd4bbaa2a7ae8b48dcb13a1e5b43883e6202ee59/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 05:15:58 UTC
File Type:
PE (.Net Exe)
Extracted files:
18
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=chayzypowerrfdjhqlfl2s52ukt25c2i3sytuhs3ioed4yqc5zmq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
040a69fe6d68904cbb33cffa3930c2a9d2d4a16377c730e8db78386034e1bfd3
NetWire
0c91c97182b3f1389437d15ff6aaa935156fc5ecc1c71c5588c0d831943acf4e
NetWire
11a0a7f8a1ad05d1989ae7ce089843379c1b6ab748e3e14d81061004cdcf1b1b
NetWire
1ca56622a5046a55fd09c9cdc61c262d9db3a009a88e0314e7bb9c64c973e9a7
NetWire
4fc5c83ab8d45e9b46bc1ab2a20e653d868e57f357b7f5b4ba433706594bc2ca
NetWire
65f6a568a39f5285acc4fd58563be987f6a128165ae0b89cffc038a26f4e54b6
NetWire
76f20f51dda2d37c9e1c9ddff49fa03defa148abcfd399dfd2c0633f5609cc7d
NetWire
cf3b59c22659d7931cf9d0338d57af01d63fbb8363ebc4c86be884194ef62e40
NetWire
e6db6d5f9019bdefffc749264a267c1927dcf5eba5a7ea3dfb10db457b6b2a16
NetWire
fcfc89b5ad3b4e406664cdd8408f56fe8b0c9a9eeb50fc821f2e89a9785c9f3e
NetWire
+ 455 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
rat botnet stealer family:netwire
Link:
https://tria.ge/reports/201007-m1n39w1pas/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
NetWire RAT payload
Netwire
Unpacked files
SH256 hash:
11c18ce1eeb123128d2782cabd4bbaa2a7ae8b48dcb13a1e5b43883e6202ee59
MD5 hash:
c73c1edd3a88792376e3d9fa2f81a5d5
SHA1 hash:
36065333473fa55af73d8f84224640185cbeded3
Link:
https://www.unpac.me/results/667f0e2d-a9dc-4240-bfd4-8949c3467a65/
SH256 hash:
4428bd386abf5e091ed855bd3b6a92474662089ac4ecbf7db24c4849bdf0e850
MD5 hash:
d0b7d1db7e64ebbaefbba583f81206de
SHA1 hash:
b8584acbac848ade967ac0a89c403a1ec86eceae
Detections:
win_netwire_g1
Create hunting rule
win_netwire_auto
Create hunting rule
Link:
https://www.unpac.me/results/667f0e2d-a9dc-4240-bfd4-8949c3467a65/
SH256 hash:
7c4e12179578579fdad465678810bf85327a47215f8678337e5d562e76ddae7a
MD5 hash:
899b57f0265bdca5bd9492e77ecca681
SHA1 hash:
4f99c0cfdb37751038df01b9620daf5adf984ada
Link:
https://www.unpac.me/results/667f0e2d-a9dc-4240-bfd4-8949c3467a65/
SH256 hash:
165b6353a27653c087637f372f70713e4e0af658e87f03ba0703d8b975525243
MD5 hash:
112730ad698bcb62cfb8c64c4862640a
SHA1 hash:
6b42b1f3f372785c40b4f80c35d6aa2e0d012429
Link:
https://www.unpac.me/results/667f0e2d-a9dc-4240-bfd4-8949c3467a65/
SH256 hash:
5e7d35b3c1c579ba40b92206057ed245537aef66b3b95c649b4e387d0434014d
MD5 hash:
35a8158b2f1ad88ea73b00da0819ca57
SHA1 hash:
d510e2a7c1c7d283d1be766dd96e20f4b8b2e481
Link:
https://www.unpac.me/results/667f0e2d-a9dc-4240-bfd4-8949c3467a65/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/11c18ce1eeb123128d2782cabd4bbaa2a7ae8b48dcb13a1e5b43883e6202ee59

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NetWire

Executable exe 11c18ce1eeb123128d2782cabd4bbaa2a7ae8b48dcb13a1e5b43883e6202ee59

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/663335/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/68883/

Comments