MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2f3c9eec055b5c11f8bbd794fde194e68a7c27cad4112d131ae999b953759ac0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	2f3c9eec055b5c11f8bbd794fde194e68a7c27cad4112d131ae999b953759ac0
SHA3-384 hash:	d1984cfb53c463af3993d9a37def9cd65a0d160b3aef5e43830cd8cb8edec33a514cc4648eeb92847309bf7f8129ad75
SHA1 hash:	50b6ce3ceca5a19475c6e00bb42ce1bc8ad5ea9b
MD5 hash:	f3211e2692125c8c5976a7f186748676
humanhash:	king-jupiter-timing-pip
File name:	Document.exe
Download:	download sample
Signature	NetWire Create hunting rule
File size:	917'504 bytes
First seen:	2021-02-12 19:05:43 UTC
Last seen:	2021-02-12 21:02:59 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	185c9d25d83bce4bd974769a832573ed (3 x RemcosRAT, 1 x NetWire)
ssdeep	12288:5TDsbND5zANBIdBM3npcpkmCoDaMycZ+PCv8:5ToHmBIupcpkmtDoc/v8
Threatray	398 similar samples on MalwareBazaar
TLSH	E21592F2AC0E8E60F05B153CE88AF6781875BCB5391D52669FD47B0ADA77358B81007B
Reporter	abuse_ch
Tags:	DHL exe NetWire RAT

abuse_ch

Malspam distributing NetWire:

HELO: mail.sunwaps.xyz
Sending IP: 207.244.226.94
From: Dhl Customer Support <help@sunwaps.xyz>
Subject: Order Delivery Failed
Attachment: Attachment.iso (contains "Document.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

303

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Document.exe

Verdict:

Malicious activity

Analysis date:

2021-02-12 19:09:17 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/f130ed20-5d7d-4dd6-94aa-b2ddfe75e1aa

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/116965/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

DNS request

Sending a custom TCP request

Creating a file

Deleting a recently created file

Sending a UDP request

Launching a process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a recently created process

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2f3c9eec055b5c11f8bbd794fde194e68a7c27cad4112d131ae999b953759ac0/

Threat name:

Win32.Backdoor.Remcos

Status:

Malicious

First seen:

2021-02-12 19:36:51 UTC

AV detection:

18 of 29 (62.07%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=f46j53aflnobd6f326kp3ymu42fhyj6k2qis2ey25gm3su3vtlaa._file

Verdict:

malicious

Label(s):

netwirerc

Result

Malware family:

netwire

Score:

10/10

Tags:

family:netwire botnet persistence stealer

Link:

https://tria.ge/reports/210212-rsfwctkpps/

Behaviour

Suspicious use of WriteProcessMemory

Adds Run key to start application

Netwire

Unpacked files

SH256 hash:

6c5faf9784abeff03bdbe2522b9da9862ac8eb9d333f608f8ef28719565968df

MD5 hash:

dff8986eae6a2b85730955c35b506f1a

SHA1 hash:

0b20d24bdd350524c25f5d513d1b3f8e4315c989

Link:

https://www.unpac.me/results/62d12cef-ac53-473b-b346-4065396dadb8/

SH256 hash:

2f3c9eec055b5c11f8bbd794fde194e68a7c27cad4112d131ae999b953759ac0

MD5 hash:

f3211e2692125c8c5976a7f186748676

SHA1 hash:

50b6ce3ceca5a19475c6e00bb42ce1bc8ad5ea9b

Link:

https://www.unpac.me/results/62d12cef-ac53-473b-b346-4065396dadb8/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2f3c9eec055b5c11f8bbd794fde194e68a7c27cad4112d131ae999b953759ac0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	APT_ArtraDownloader2_Aug19_1 Create hunting rule
Author:	Florian Roth
Description:	Detects ArtraDownloader malware
Reference:	https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	win_netwire_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator