MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 21f4e588b0c41e6c4b6ebc201af2a7614cdaf7726b615e6f28b90fa6e61005d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 21f4e588b0c41e6c4b6ebc201af2a7614cdaf7726b615e6f28b90fa6e61005d7
SHA3-384 hash: 552e33f9fd56aee310d6968bf74c848c418924766cec072d78aa3222fe6f44c46b569a19894d473fa520497a1329c398
SHA1 hash: 03b629f436ac2e7b2a4ff0f4fbfd75e63dc1c2c6
MD5 hash: 96d50427e682c4899ffef6c1ac0b9ab2
humanhash: sad-nebraska-cola-burger
File name:SKM_C258201001130020005057R1RE.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:1'104'896 bytes
First seen:2021-03-05 13:09:32 UTC
Last seen:2021-03-05 15:20:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'742 x AgentTesla, 19'607 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:vEl1lo8nW9DUk1PQIITXdZS4/MK4sX5JOKl6NioFCCtE9phJI:vpF1PQ5Xdh/2s2/NioFCCi
Threatray 385 similar samples on MalwareBazaar
TLSH 6735093036AA5219E47E5B300D74A1D163FA7E6ABF15CB1E2859238C9F335438F11BB6
Reporter abuse_ch
Tags:exe NetWire RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: vps38947.servconfig.com
Sending IP: 144.208.66.19
From: Williams Mia <rvfwd@avalonjobs.net>
Subject: Fwd: Payment Invoice
Attachment: SKM_C258201001130020005057R1RE.IMG (contains "SKM_C258201001130020005057R1RE.exe")

NetWire RAT C2:
severdops.ddns.net

Intelligence

File Origin
# of uploads :
2
# of downloads :
460
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SKM_C258201001130020005057R1RE.exe
Verdict:
No threats detected
Analysis date:
2021-03-05 13:18:17 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4a9f26f4-7fb8-4b1b-a53b-0e47f97b15d6

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
NetWire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/122473/
Detection(s):
SecuriteInfo.com.FileRepMalware.11508.21294.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/629770
Signature
.NET source code contains very large strings
Contains functionality to steal Chrome passwords or cookies
Sigma detected: NetWire
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/21f4e588b0c41e6c4b6ebc201af2a7614cdaf7726b615e6f28b90fa6e61005d7/
Threat name:
ByteCode-MSIL.Trojan.Woreflint
Create hunting rule
Status:
Malicious
First seen:
2021-03-05 13:10:12 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=eh2olcfqyqpgys3oxqqbv4vhmfgnv53snnqv43zixeh2nzqqaxlq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
0179848cfc3414a2799af814eada847b33e5492f5824bf0b2418137dc4c02d47
NetWire
482a6a0bf95d313de664dec7523d7487995d5f26e1a30b8bc62c0a5e1431fbd7
NetWire
4fea6e355cf21e8c42cde98a6ee6f03e8ea24ec6df6a5711b9a31cb43eb93fc6
NetWire
62e8d80b582bb90531dd63743d085910e20cdc35494bea3209fd80e22cff13bd
NetWire
73429ed369e556843e28f21b233a49aa9cc7b55d36c5be69f3745a75d17eaf1f
NetWire
7511c244b32ec5bc59ff7173ee5aa83a764ea6607522b79cc99c5537907e50e7
NetWire
8c940846bd45f30de0358c90c8caef670b5e15bc9468452418d215c40ed62a20
NetWire
aae45a77eeaca2d69630e035293e25a47f81d5b7612bace059d1678154485b85
NetWire
cef2f777b4c29a5ced187382e3c0a0ee61d4c71471fc5d100b78a4e88f4324de
NetWire
d88b21c1b67f0aee44019a8b54a72d1662ae3c2939ff593fe0d1844cf17a5c53
NetWire
+ 375 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/210305-lmpzxmmtqj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Uses the VBS compiler for execution
Unpacked files
SH256 hash:
f9d949d2f56c449c5d346bb93ed04d38426f563b022dd179ae330dab46682c3b
MD5 hash:
871e23d748ba756eaab5777708f250f8
SHA1 hash:
c9816d4ab38541aaab9aa3eab7cb4898d0b72e4a
Link:
https://www.unpac.me/results/674a9683-5dc6-49db-a997-f4e3aaff03d3/
SH256 hash:
21f4e588b0c41e6c4b6ebc201af2a7614cdaf7726b615e6f28b90fa6e61005d7
MD5 hash:
96d50427e682c4899ffef6c1ac0b9ab2
SHA1 hash:
03b629f436ac2e7b2a4ff0f4fbfd75e63dc1c2c6
Link:
https://www.unpac.me/results/674a9683-5dc6-49db-a997-f4e3aaff03d3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tnega
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/21f4e588b0c41e6c4b6ebc201af2a7614cdaf7726b615e6f28b90fa6e61005d7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

img c6991d407bc08bb9e50dfd7f42d2992530e25b9ef611a461bf4d75b907940242

NetWire

Executable exe 21f4e588b0c41e6c4b6ebc201af2a7614cdaf7726b615e6f28b90fa6e61005d7

(this sample)

  
Dropped by
MD5 11347b3a4c943ce6e6c590d41e9b83c9
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 c6991d407bc08bb9e50dfd7f42d2992530e25b9ef611a461bf4d75b907940242
Cape
Cape
https://www.capesandbox.com/analysis/122473/

Comments