MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27c7e09f3d97d73a998e1cfb8fca499b77b3045797459c7696b924106d2866c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27c7e09f3d97d73a998e1cfb8fca499b77b3045797459c7696b924106d2866c6
SHA3-384 hash: 057f2eff59cae08d4b36108ee99e8e18f0880757d7ba29fcef0b610f25de741b7eb239c8563b366b9d201d8762e19213
SHA1 hash: e8c6c918565e807e4c52f8af92fee9ee12cd1394
MD5 hash: 173732c4151ba7583010f3f45a610817
humanhash: table-island-pip-zebra
File name:173732c4151ba7583010f3f45a610817
Download: download sample
Signature NetWire
Create hunting rule
File size:129'024 bytes
First seen:2020-11-17 12:09:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'207 x SnakeKeylogger)
ssdeep 1536:rgrJPg17xWMIiOu5oSz5ugrJPg17xWMIiOu5oSz5:rgZc7xWMIi33z5ugZc7xWMIi33z5
Threatray 317 similar samples on MalwareBazaar
TLSH 70C35266F387B816F528173A0AAE4010E2F7E36119F3DA75BDD4E3F760A1015B70A987
Reporter seifreed
Tags:NetWire

Intelligence

File Origin
# of uploads :
1
# of downloads :
263
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Launching a process
Creating a process with a hidden window
Adding an access-denied ACE
Creating a file
Creating a window
Creating a file in the Windows subdirectories
Enabling the 'hidden' option for recently created files
Creating a process from a recently created file
Moving a recently created file
Creating a file in the %AppData% subdirectories
Searching for the window
Creating a file in the %temp% directory
Moving a file to the %temp% directory
Modifying an executable file
Deleting a recently created file
Sending an HTTP GET request
Sending a UDP request
Connection attempt
Sending a TCP request to an infection source
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process by context flags manipulation
Enabling autorun
Infecting executable files
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27c7e09f3d97d73a998e1cfb8fca499b77b3045797459c7696b924106d2866c6/
Threat name:
ByteCode-MSIL.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 19:27:00 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=e7d6bhz5s7ltvgmodt5y7ssjtn33gbcxs5czy5uwxesba3jim3da._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
151f57078e89aa2f81fcb307bf88fe23e9f2437a4df1e37def5d0b78797e12f8
NetWire
2e54ae1fe78471492cc217d238fcd7f0158ae8f22a35e9576a91b3a6614c2d08
NetWire
2e5d08e10497cdd14499b4ae823f7d639a738d37784882db758e70fa3804e4e9
NetWire
7b9a1aa88be62eb638af26146fce0a1b71aec646d2495fb350dd6d56997e7582
NetWire
7c7a7c3e89daeb57bcd8fe5a895461161efafa3a5b2f111e0e23aff6b3f9535a
NetWire
b4b073df62d2616baff7c0c48cc6a85e5f5211aa6979fb65ac6e9b328687cec1
NetWire
c952644e56294c56309d52fffcacdc6d1d054625a3e438727c0a7c3d944eb3e8
NetWire
dfc8f0a7456a2b40908d901c2468d372bd859abda04e50ef4cf45ec84668cdcb
NetWire
e04977f7d1fbf8b3a69237bbd2170af6c3046a8ce29e2732cd7c72f079f0e0f8
NetWire
f09dc0b3275b4c1e3a616911805011c2871af1407599493dc980b6987cb313eb
NetWire
+ 307 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet persistence rat stealer
Link:
https://tria.ge/reports/201117-klk7y1zl8j/
Behaviour
Delays execution with timeout.exe
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Program crash
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Checks computer location settings
Executes dropped EXE
Modifies Installed Components in the registry
ServiceHost packer
NetWire RAT payload
Netwire
Unpacked files
SH256 hash:
27c7e09f3d97d73a998e1cfb8fca499b77b3045797459c7696b924106d2866c6
MD5 hash:
173732c4151ba7583010f3f45a610817
SHA1 hash:
e8c6c918565e807e4c52f8af92fee9ee12cd1394
Link:
https://www.unpac.me/results/2f7dcf60-2255-46c0-a45f-aabe2cb7d1ef/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments