MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 204b5f6085ac0a3082590aa0518074cb2e7fa9ebb6ccb4106cbf57588453104e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 204b5f6085ac0a3082590aa0518074cb2e7fa9ebb6ccb4106cbf57588453104e
SHA3-384 hash: 9992da4ca00b564a97212b81b09b23e5b6ac11be4ae3ab2b2b4a95256681920fb6bd6d8a3600081f846129dc82dc9c53
SHA1 hash: 2226049bcdc6357748f8ba034105c8dfab19f2cd
MD5 hash: 41aa9c4c4cbca6e068337c167d9dd116
humanhash: five-carbon-sodium-golf
File name:CF10550U5400-PDF.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:705'528 bytes
First seen:2021-03-10 08:12:04 UTC
Last seen:2021-03-10 09:49:17 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9c76d795274eea6761f50f4c399de879 (1 x NetWire, 1 x RemcosRAT)
ssdeep 12288:OnxhNANd5U78E2iMwLvMtNqAP3HZ04RRW:OxcaBNvMrd/I
Threatray 385 similar samples on MalwareBazaar
TLSH 57E49D71F6B0003AD2371E7DDCDB93AD583A7E003A592D461BE66D585F782C0792E28B
Reporter TeamDreier
Tags:NetWire

Intelligence

File Origin
# of uploads :
2
# of downloads :
397
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
CF10550U5400-PDF.exe
Verdict:
Malicious activity
Analysis date:
2021-03-10 08:15:54 UTC
Tags:
installer rat netwire trojan
Link:
https://app.any.run/tasks/2e126d5a-128b-4903-982d-d4ff8046dac4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/123505/
Detection(s):
PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Creating a file
Moving a recently created file
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/634008
Signature
Contains functionality to detect sleep reduction / modifications
Contains functionality to steal Chrome passwords or cookies
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Sigma detected: Executables Started in Suspicious Folder
Sigma detected: Execution in Non-Executable Folder
Sigma detected: NetWire
Sigma detected: Suspicious Program Location Process Starts
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
Gathering data
Threat name:
Win32.Adware.DealPly
Create hunting rule
Status:
Malicious
First seen:
2021-03-10 08:13:05 UTC
AV detection:
22 of 47 (46.81%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ebfv6yefvqfdbaszbkqfdaduzmxh7kplw3gliedmx5lvrbctcbha._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
242d38ebd19ccd5c3b65eb9aad87844fc17ca11075fab108dc00d26cc0d137ba
NetWire
3ffc5daa049116311ac1363623b7a8960b7aabb4b874d1126a358b8d483e33cd
NetWire
5759a1711d0f78b7be3f76aa9e451516f93d91370586f863dd5a68291c82ee3b
NetWire
5d3724894277765b2182d26064f7891d58b3f3614f6adaa281a7b673d2b7b071
NetWire
85c2475f5bb564338727b25d030019e2ec0f08a9892df26024e45339ef3c0792
NetWire
abd18b2d7cfc702e56442f2549808b301f2e0fc214cdf2230d5fbefc9620fd42
NetWire
cb9713e99535b6589f62d352c0a22488ae19d4b02df7f33e3fc052e9c8414481
NetWire
cef2f777b4c29a5ced187382e3c0a0ee61d4c71471fc5d100b78a4e88f4324de
NetWire
d88b21c1b67f0aee44019a8b54a72d1662ae3c2939ff593fe0d1844cf17a5c53
NetWire
dfc8f0a7456a2b40908d901c2468d372bd859abda04e50ef4cf45ec84668cdcb
NetWire
+ 375 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet persistence stealer
Link:
https://tria.ge/reports/210310-5nfbwxy662/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Netwire
Unpacked files
SH256 hash:
d6007fb578373248c8f154bc3f9ee48e53736a38fc6fbf6e609860c462ed420c
MD5 hash:
2ed90bee7edaa9557702512d8643240f
SHA1 hash:
638bd30c83dde6975fdf492511cf09415b3f8a6d
Link:
https://www.unpac.me/results/1a3e62f6-a465-4021-a35e-4b35f4de7fcd/
SH256 hash:
204b5f6085ac0a3082590aa0518074cb2e7fa9ebb6ccb4106cbf57588453104e
MD5 hash:
41aa9c4c4cbca6e068337c167d9dd116
SHA1 hash:
2226049bcdc6357748f8ba034105c8dfab19f2cd
Link:
https://www.unpac.me/results/1a3e62f6-a465-4021-a35e-4b35f4de7fcd/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/204b5f6085ac0a3082590aa0518074cb2e7fa9ebb6ccb4106cbf57588453104e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_ArtraDownloader2_Aug19_1
Create hunting rule
Author:Florian Roth
Description:Detects ArtraDownloader malware
Reference:https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:MALWARE_Win_NetWire
Create hunting rule
Author:ditekSHen
Description:Detects NetWire RAT
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/123505/

Comments