MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c646687e4988d451dedfe0d30dc1b6d42bc757dd69f3c638e972169d0278d2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments

SHA256 hash:	1c646687e4988d451dedfe0d30dc1b6d42bc757dd69f3c638e972169d0278d2a
SHA3-384 hash:	8d4faae329df77634deae1475a53bc633b00967831421b05c7672bb4483a4e753a88d62837ba39a92df2f20cc1dc3827
SHA1 hash:	48209428aff4d58543d4be4e5c9755e2668aed76
MD5 hash:	cdee9b23a13fc0d63802bf52963787ac
humanhash:	crazy-network-timing-alabama
File name:	cdee9b23a13fc0d63802bf52963787ac.exe
Download:	download sample
Signature	NetWire Create hunting rule
File size:	531'456 bytes
First seen:	2020-10-08 05:20:55 UTC
Last seen:	2020-10-08 05:48:49 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep	12288:HVXy0JaBHMEdi8CKQ4TMWqMaqLQyhdRA1rq:51U4dKQ4TMFOG1
Threatray	471 similar samples on MalwareBazaar
TLSH	F0B4C74FBA452CADC513FCF3BC285E106130D91C238E86163119B36AB9BA75D7A931E7
Reporter	abuse_ch
Tags:	exe NetWire nVpn RAT

abuse_ch

NetWire RAT C2:
pre08080.nsupdate.info:4788 (79.134.225.76)

Pointing to nVpn:

% Information related to '79.134.225.0 - 79.134.225.127'

% Abuse contact for '79.134.225.0 - 79.134.225.127' is 'abuse@privacyfirst.sh'

inetnum: 79.134.225.0 - 79.134.225.127
netname: PRIVACYFIRST-EU
country: EU
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
org: ORG-TPP6-RIPE
created: 2020-07-14T15:26:02Z
last-modified: 2020-07-14T15:31:06Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

232

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Netwire

Link:

https://www.capesandbox.com/analysis/69067/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Unauthorized injection to a recently created process

Launching a process

Creating a file

DNS request

Creating a window

Sending a TCP request to an infection source

Enabling autorun by creating a file

Result

Threat name:

NetWire

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/484918

Signature

Adds a directory exclusion to Windows Defender

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains functionality to steal Chrome passwords or cookies

Creates an undocumented autostart registry key

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NetWire

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected NetWire RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

netwire

Link:

https://mwdb.cert.pl/sample/1c646687e4988d451dedfe0d30dc1b6d42bc757dd69f3c638e972169d0278d2a/

Threat name:

ByteCode-MSIL.Backdoor.NetWiredRc

Status:

Malicious

First seen:

2020-10-08 05:22:07 UTC

AV detection:

22 of 29 (75.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=drsgnb7etcgukhpn7ygtbxa3nvbly5l522ptyy4os4qwtubhruva._file

Verdict:

malicious

Label(s):

netwirerc

Result

Malware family:

netwire

Score:

10/10

Tags:

rat botnet stealer family:netwire

Link:

https://tria.ge/reports/201008-89rtjhww9s/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

NetWire RAT payload

Netwire

Unpacked files

SH256 hash:

1c646687e4988d451dedfe0d30dc1b6d42bc757dd69f3c638e972169d0278d2a

MD5 hash:

cdee9b23a13fc0d63802bf52963787ac

SHA1 hash:

48209428aff4d58543d4be4e5c9755e2668aed76

Link:

https://www.unpac.me/results/7a665300-e679-4cef-a89c-06c27a3081a5/

SH256 hash:

895097b860343cda36b505ddc68793b1be1c366928779ce6cae31d7de8d8cb4f

MD5 hash:

812e8140d77f681596632cc8463c01e1

SHA1 hash:

4d3645a53bd78bf79f8fed106906be0251ace829

Link:

https://www.unpac.me/results/7a665300-e679-4cef-a89c-06c27a3081a5/

SH256 hash:

d18717962097de66fc68ce7afbbe0456d1e2cd99480acd91e4b39a0f3835c81a

MD5 hash:

29f32a06a1b5e62b8a7d6a58fd3e40d7

SHA1 hash:

5c8d6c7f2d913f68b2e61097eba0fd7457cfeef8

Link:

https://www.unpac.me/results/7a665300-e679-4cef-a89c-06c27a3081a5/

SH256 hash:

165b6353a27653c087637f372f70713e4e0af658e87f03ba0703d8b975525243

MD5 hash:

112730ad698bcb62cfb8c64c4862640a

SHA1 hash:

6b42b1f3f372785c40b4f80c35d6aa2e0d012429

Link:

https://www.unpac.me/results/7a665300-e679-4cef-a89c-06c27a3081a5/

SH256 hash:

35e1a18b70184f73d428b8a5e74868d64414991952cb4d602a025a64afdef59e

MD5 hash:

60a3a71ca505a406bcfbd9ab68588a44

SHA1 hash:

d8ce5dd4634276a7320e92ccf68392ff925d1d07

Detections:

win_netwire_g1

win_netwire_auto

Link:

https://www.unpac.me/results/7a665300-e679-4cef-a89c-06c27a3081a5/

Parent samples :

1c646687e4988d451dedfe0d30dc1b6d42bc757dd69f3c638e972169d0278d2a
c35d8629ac725a6fd6bc953e5f86e4fa1b8a3680b367b52b33880ddeaa7492d4
f95d6d1493ac922503b6a6a5532cd20bb87f35f07af72b7748915409c7e5b99f
e7f8e0a363a5042ec6e8365095076dd56636ade1cd6cdd4df9ea47a953ea8c22
2b4569753be7e894aff4079e30581195d611e123a77ddb5115e05d15f16ed887
7511c244b32ec5bc59ff7173ee5aa83a764ea6607522b79cc99c5537907e50e7

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

NetWiredRC

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1c646687e4988d451dedfe0d30dc1b6d42bc757dd69f3c638e972169d0278d2a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_netwire_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator