MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 261f13f9e6d08869b41dca972016f177e1cefada9155d806a18f590c3f487a5f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 261f13f9e6d08869b41dca972016f177e1cefada9155d806a18f590c3f487a5f
SHA3-384 hash: 224c3f4638e6f02fb97308480bdc8ce085db4e709af7bcfa2cb91f9a722c505cb2a3a882d500710b96cd7ea7247f621e
SHA1 hash: 8607cd11521bda26cfbf51a0575c2fb958997c39
MD5 hash: 5549e26ce513da5e55523adf722a81be
humanhash: alpha-fillet-beryllium-cold
File name:261f13f9e6d08869b41dca972016f177e1cefada9155d806a18f590c3f487a5f
Download: download sample
Signature NetWire
Create hunting rule
File size:413'696 bytes
First seen:2021-01-31 12:57:38 UTC
Last seen:2021-01-31 14:28:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 5becb8457cb69c375aa61c584223f1f7 (3 x NetWire)
ssdeep 12288:tnmHRMHaM33RiPPEciVx74gSEyji0/Wq:tnmHRMHaMnRQPdiVxHyjiIW
Threatray 113 similar samples on MalwareBazaar
TLSH 4694E021B6D2C8B2F323153019B057766AB8EE335B61D7AB9B109F8DED34285493D372
Reporter adulau
Tags:NetWire

Intelligence

File Origin
# of uploads :
2
# of downloads :
331
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
261f13f9e6d08869b41dca972016f177e1cefada9155d806a18f590c3f487a5f
Verdict:
Suspicious activity
Analysis date:
2021-01-31 13:01:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/a90441b0-42a6-45ca-854b-e56755eafbea

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Sending a UDP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching a process
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Netwire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/594782
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Contains functionality to steal Internet Explorer form passwords
Hijacks the control flow in another process
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file has nameless sections
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Yara detected Netwire RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
netwire
Create hunting rule
Link:
https://mwdb.cert.pl/sample/261f13f9e6d08869b41dca972016f177e1cefada9155d806a18f590c3f487a5f/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 20:04:09 UTC
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
4255ae6b31d6068463b663c1871ac8cee3461b0d3fbf642f96cf9a3e8817803c
NetWire
4c5670614501c7d604bc9c591c931d27a564038c042617214ea6e70b037bbcaa
NetWire
94fa3ff2ef14ae0fcd461c89f90deae5ed6417a238ec5131ef6cb80400de0586
NetWire
982d5516b54a9ca64fa7cf03833f79f4b963504652997cba751cee2b3ff96979
NetWire
9a8b855058e1d8a31a302dfa49caa68baec7940553466f303a65c5eb032fb4e3
NetWire
a5e7773e86e1f8feacc75ced3053ac3d44af73d5b2ec72005c7ba2cd465f1ef3
NetWire
ac0ca89c2e434d4128516896f5563003a1179583181d0d1fd06754f06ab4deed
NetWire
c41615161da87837531dc1af5636303677156e3393109d835cbc8d1994e33218
NetWire
db07bff94b6ace3907b55971ba6234e6b232a66f2efd18425c7e21204025e6e3
NetWire
fcafbd4579ef27eeeea5b955b4c04f4bb74a64516e3cfd55e280bd7dd9d79750
NetWire
+ 103 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
ransomware upx
Link:
https://tria.ge/reports/210131-s1aacq2vh6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Executes dropped EXE
UPX packed file
Unpacked files
SH256 hash:
261f13f9e6d08869b41dca972016f177e1cefada9155d806a18f590c3f487a5f
MD5 hash:
5549e26ce513da5e55523adf722a81be
SHA1 hash:
8607cd11521bda26cfbf51a0575c2fb958997c39
Link:
https://www.unpac.me/results/75ef9bc2-1a1f-4923-afa7-e5e3421ed53b/
SH256 hash:
ee95b7b4671f425598c1a1a22c3bc15308b9f587a9aa1679fa17c1de7871cd96
MD5 hash:
f315143ac6f3751f672cbd5ea9f34bd5
SHA1 hash:
25c8db00c79710634413beeedbdf47516141dfb6
Detections:
win_netwire_g1
Create hunting rule
win_netwire_auto
Create hunting rule
Link:
https://www.unpac.me/results/75ef9bc2-1a1f-4923-afa7-e5e3421ed53b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/261f13f9e6d08869b41dca972016f177e1cefada9155d806a18f590c3f487a5f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:suspicious_packer_section
Create hunting rule
Author:@j0sm1
Description:The packer/protector section names/keywords
Reference:http://www.hexacorn.com/blog/2012/10/14/random-stats-from-1-2m-samples-pe-section-names/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/114936/

Comments