MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



NetWire


Vendor detections: 14


Intelligence 14 IOCs YARA 5 File information Comments

SHA256 hash: 2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58
SHA3-384 hash: dc212966ca3836a4cec0533a196bfaf0785001fe39549e86733e4960de5d8e484f558d5b9fd439a6ee1c3fb6f23594a7
SHA1 hash: 8062220b613b56116d638b3d7f5dd043f3bc096e
MD5 hash: e366f96c9b5c5528426a116eb49ef445
humanhash: item-eight-nuts-avocado
File name:RECHNUNG-RP0188843894.exe
Download: download sample
Signature NetWire
File size:1'299'456 bytes
First seen:2022-08-05 08:34:53 UTC
Last seen:2022-08-05 09:12:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (31'209 x AgentTesla, 10'508 x Formbook, 5'466 x SnakeKeylogger)
ssdeep 24576:iTJjpjM7KzOkDwPN2XanQBOrOlaLlpxtRYNNHV3lSpWBb62:EjW77kQNaaQB6w+tR63AEbT
TLSH T19855F1D153898B42CC6A0EB8E3122524C776EC7FEAFEC6C98DC7B8A695367C31550907
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 772e9cb139dccecf (1 x NetWire)
Reporter @lowmal3
Tags:exe NetWire

Intelligence


File Origin
# of uploads :
2
# of downloads :
281
Origin country :
DE DE
Mail intelligence
No data
Vendor Threat Intelligence
Malware family:
netwire
ID:
1
File name:
RECHNUNG-RP0188843894.exe
Verdict:
Malicious activity
Analysis date:
2022-08-05 08:36:31 UTC
Tags:
trojan netwire

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lokibot packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
NetWire
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Threat name:
ByteCode-MSIL.Trojan.LokiBot
Status:
Malicious
First seen:
2022-08-05 07:46:39 UTC
File Type:
PE (.Net Exe)
Extracted files:
41
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
netwirerc
Result
Malware family:
netwire
Score:
  10/10
Tags:
family:netwire botnet rat stealer
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
NetWire RAT payload
Netwire
Malware Config
C2 Extraction:
xman2.duckdns.org:4433
Unpacked files
SH256 hash:
69a328f411d1f9272cbfa750b190b6bda787a7a9fd3b22b3700e676de2f804e1
MD5 hash:
bc06dbd2ed336c7c9e801da4201eee3f
SHA1 hash:
e0d44b3f273f5496079c4c9f1759b79e9281961b
SH256 hash:
a523552ad961e73f074882dcce7d34e37340b315feb248a95ec7003f784a77f9
MD5 hash:
0c4b553cee565964d438d3e2a2a2e563
SHA1 hash:
2cae98f35598dde684ced1c7213189033ceed186
Detections:
win_netwire_g1
SH256 hash:
39c2d879c57f07305ce60412dc8a88f02e51f1a14a06cc605768d1d7f5313807
MD5 hash:
db51fe170a9e5d6ec5429a2fbd9d0353
SHA1 hash:
e30a58125fc41322db6cf2ccb6a6d414ed379016
SH256 hash:
832b951855d1e3f629dce9d7662789ff6d38afd1951432a037188bfd52d00a5e
MD5 hash:
afe0ec287d75e02d7901e50015b3ffaf
SHA1 hash:
8e089ddf779a27463c7e19e50382b49a5e43b248
SH256 hash:
a9c5b2c628a47247402ff05d399855caf6f6a22146d44cd0fd9d7fc05a65ba66
MD5 hash:
228ff1006be83039e4de2b5e0475a5b0
SHA1 hash:
3adef5cc343067fa6b9d5e712114dc619c867a72
SH256 hash:
2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58
MD5 hash:
e366f96c9b5c5528426a116eb49ef445
SHA1 hash:
8062220b613b56116d638b3d7f5dd043f3bc096e

YARA Signatures


MalareBazaar uses YARA rules from several public and non-public repositories, such as Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious proccess dumps they may create. Please note that only results from TLP:WHITE rules are being displayeyd.

Rule name:cobalt_strike_tmp01925d3f
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:MALWARE_Win_NetWire
Author:ditekSHen
Description:Detects NetWire RAT
Rule name:pe_imphash
Rule name:Skystars_Malware_Imphash
Author:Skystars LightDefender
Description:imphash

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

Executable exe 2a05a23d8879f9d001af335779b5102dd644b08d2f106353c28c8ce303ee9b58

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments