MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 26dfa8512e892dc8397c4ccbbe10efbcf85029bc2ad7b6b6fe17d26f946a01bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWalker


Vendor detections: 3


Intelligence 3 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 26dfa8512e892dc8397c4ccbbe10efbcf85029bc2ad7b6b6fe17d26f946a01bb
SHA3-384 hash: c84e586b9ed647beb24eb350622835ad5a8763fe9c9ec58b35cbb837b68b4b5015f20655de50c39e508bffd83b059f13
SHA1 hash: 794589026bdc8b01cad097ffcd50be37a87e7c29
MD5 hash: 59b00f607a7550af9a2332c730892845
humanhash: fanta-enemy-saturn-bacon
File name:26dfa8512e892dc8397c4ccbbe10efbcf85029bc2ad7b6b6fe17d26f946a01bb.bin
Download: download sample
Signature NetWalker
Create hunting rule
File size:70'656 bytes
First seen:2020-06-01 14:28:25 UTC
Last seen:2020-08-20 21:23:51 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e82dd51b077167be63c004bed23d0c1e (40 x NetWalker, 2 x GuLoader, 1 x ShikataGaNai)
ssdeep 1536:cuCWRxL7hbUiQfovePbUU+hhOZuIWiFp+ZfaBZebC33O+cX2Rc:XCWf7VJQfmePbvkhOZu1iFBBZebC3MXH
Threatray 58 similar samples on MalwareBazaar
TLSH 70635A83F682C2B0D98646F96BFFF37E08725D14977589C3CB521C01E9398E2593A35A
Reporter Anonymous
Tags:NetWalker


Avatar
Anonymous
Zero2Automated Course

Intelligence

File Origin
# of uploads :
3
# of downloads :
2'029
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Ransomware.Netwalker-7671868-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Netwalker
Create hunting rule
Status:
Malicious
First seen:
2020-05-13 18:48:16 UTC
File Type:
PE (Exe)
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0d7ee7ce88e790ad66aa53589f5a2638207bc3adf2eb4f8a813fd52b5b22ba27
NetWalker
12717add64ecf32d7bcb6b2662becbff6b516cf8073f399dc5e4d3615d452e89
NetWalker
167bf2356e65b04407cd2d8299a9b315f213808b04c341f6aad5820fc46a3c49
NetWalker
29aef790399029029e0443455d72a8b928854a0706f2e211ae7a03bba0e3d4f4
NetWalker
3ba905e1cda7307163d4c8fe3fd03c2fbce7eda030522084e33d0604c204630e
NetWalker
4df67a9e8abab33856a586cea38b0d365fbbe0d91ee848f270c65f0125d2d677
NetWalker
5d869c0e077596bf0834f08dce062af1477bf09c8f6aa0a45d6a080478e45512
NetWalker
74fd9bbdd8a484640e4b0405a1da84734a0a9c2604ac1b0a39fa2e28b0c12614
NetWalker
84b8dbafd5cd64fb300b30bf943430a18f34cad3f0d8f7251d34354fea85aab2
NetWalker
b2d68a79a621c3f9e46f9df52ed19b8fec22c3cf5f4e3d8630a2bc68fd43d2ee
NetWalker
+ 48 additional samples on MalwareBazaar
Result
Malware family:
netwalker
Create hunting rule
Score:
  10/10
Tags:
family:netwalker persistence ransomware spyware
Link:
https://tria.ge/reports/201109-4vj8jd9w96/
Behaviour
Interacts with shadow copies
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Modifies service
Deletes itself
Reads user/profile data of web browsers
Modifies extensions of user files
Deletes shadow copies
Netwalker Ransomware
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:netwalker_ransomware
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Netwalker ransomware
Reference:https://www.ccn-cert.cni.es/comunicacion-eventos/comunicados-ccn-cert/9802-publicado-un-informe-de-codigo-danino-sobre-netwalker.html
Rule name:win_mailto_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments