MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 17e6d7c107027e70986b47c51333b519c0c4b779f0c010462bfaaa740e7e7b18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 10

Intelligence 10 IOCs YARA 8 File information Comments

SHA256 hash:	17e6d7c107027e70986b47c51333b519c0c4b779f0c010462bfaaa740e7e7b18
SHA3-384 hash:	0f178601c844106c548c04c2ed8cc573fabb5978434363e3d8ce1a1b2d2bab2b07378482ad3e1cdd195082a3e79188c4
SHA1 hash:	69a7bcbae3f0bb0d2fa9338559e637feac77a2a9
MD5 hash:	a419de086876ac9ffc25366e56c8c852
humanhash:	vermont-yellow-paris-burger
File name:	PAYMENT_.EXE
Download:	download sample
Signature	NetWire Create hunting rule
File size:	553'984 bytes
First seen:	2021-02-22 07:28:47 UTC
Last seen:	2021-02-23 15:30:03 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep	12288:GIJElPCu4Uodhi+AY1NNBYvP/uPMfZ1PGjufL2nIjyewRzs8aAkas6cw6fe:GIiPCu/shxzYGPMfjPQKLWRzGEPRf
Threatray	369 similar samples on MalwareBazaar
TLSH	7CC4121823D8671AF5BE67F7683119043331BA2AA435E15E9FD010DE61B27C1DAB2F23
Reporter	abuse_ch
Tags:	exe NetWire RAT

abuse_ch

Malspam distributing NetWire:

HELO: infinitymail.dedicated.co.za
Sending IP: 154.0.174.127
From: Capitec Bank <No-reply@capitecbank.co.za>
Reply-To: No-reply@capitec.co.za
Subject: Payment Notification
Attachment: Payment notification.r10 (contains "PAYMENT_.EXE")

Intelligence

File Origin

# of uploads :

# of downloads :

290

Origin country :

n/a

Vendor Threat Intelligence

Detection:

NetWire

Link:

https://www.capesandbox.com/analysis/118240/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Sending a UDP request

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Unauthorized injection to a recently created process

Creating a file

Sending a TCP request to an infection source

Enabling autorun by creating a file

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

NetWire

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/613804

Signature

Binary contains a suspicious time stamp

Contains functionality to steal Chrome passwords or cookies

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NetWire

Sigma detected: Scheduled temp file as task from temp location

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected NetWire RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

netwire

Link:

https://mwdb.cert.pl/sample/17e6d7c107027e70986b47c51333b519c0c4b779f0c010462bfaaa740e7e7b18/

Threat name:

ByteCode-MSIL.Trojan.Generic

Status:

Suspicious

First seen:

2021-02-22 07:29:27 UTC

AV detection:

11 of 47 (23.40%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=c7tnpqihaj7hbgdli7crgm5vdhamjn3z6dabarrl7kvhidt6pmma._file

Verdict:

malicious

Label(s):

netwirerc

Result

Malware family:

netwire

Score:

10/10

Tags:

family:netwire botnet rat stealer

Link:

https://tria.ge/reports/210222-1m2sn4t26a/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

NetWire RAT payload

Netwire

Unpacked files

SH256 hash:

a402c26b6ff9d8edd32fd9641adb8847a13b3d9b3a47beba9adecf7e871dafea

MD5 hash:

21a18afb9237d10325abb9e1c9162caa

SHA1 hash:

df2eb75ef68e814b849dd8ada0282fbc84b7d295

Detections:

win_netwire_g1

win_netwire_auto

Link:

https://www.unpac.me/results/2ec0fa1d-f4ba-48b0-a54b-128f6cf5beda/

SH256 hash:

a21c471c6dbf4e0903d030e0cc1e4d4f1119bcee2bce07fb63868996d6f250c4

MD5 hash:

785159d7d511b1756ed02cf2038f5ae0

SHA1 hash:

ce4e15e8d0b67b0820a86f66b2d32ca0bff23812

Link:

https://www.unpac.me/results/2ec0fa1d-f4ba-48b0-a54b-128f6cf5beda/

SH256 hash:

f0a09c48af16c079c37ad0914f18897976357981fe5ee6f556ab9f9f70b9a671

MD5 hash:

f984a71581f6da5732110be2a569a392

SHA1 hash:

10de05b6b35fc5dbc00c42d59a4b850bcaae01e6

Link:

https://www.unpac.me/results/2ec0fa1d-f4ba-48b0-a54b-128f6cf5beda/

SH256 hash:

17e6d7c107027e70986b47c51333b519c0c4b779f0c010462bfaaa740e7e7b18

MD5 hash:

a419de086876ac9ffc25366e56c8c852

SHA1 hash:

69a7bcbae3f0bb0d2fa9338559e637feac77a2a9

Link:

https://www.unpac.me/results/2ec0fa1d-f4ba-48b0-a54b-128f6cf5beda/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFu Create hunting rule
Author:	ditekSHen
Description:	Detect executables with stomped PE compilation timestamp that is greater than local current time

Rule name:	IPPort_combo_mem Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	Malicious_BAT_Strings Create hunting rule
Author:	Florian Roth
Description:	Detects a string also used in Netwire RAT auxilliary
Reference:	https://pastebin.com/8qaiyPxs

Rule name:	MAL_unspecified_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects unspecified malware sample
Reference:	Internal Research

Rule name:	netwire Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect netwire in memory
Reference:	internal research

Rule name:	Suspicious_BAT_Strings Create hunting rule
Author:	Florian Roth
Description:	Detects a string also used in Netwire RAT auxilliary
Reference:	https://pastebin.com/8qaiyPxs

Rule name:	win_netwire_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator