MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31a804fddf5f1ed1d5c1a69772bc92026f90696a6903a3a7ebaf7aef6dfa9478. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31a804fddf5f1ed1d5c1a69772bc92026f90696a6903a3a7ebaf7aef6dfa9478
SHA3-384 hash: bb76c549f84eaebeff17d7ff1e70dd2de11d5802a38eec3f04bea0a6ee8b4b56ec26edf8f08a366508593d90cc552db7
SHA1 hash: b22e2b425e3a663f7404579ebf03507713b45959
MD5 hash: 307e257292be5d47304c1712c8bd1342
humanhash: dakota-lithium-montana-oxygen
File name:307e257292be5d47304c1712c8bd1342.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:395'930 bytes
First seen:2021-03-05 12:59:54 UTC
Last seen:2021-03-05 15:20:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:YBlL/X3MBj+8DTgKtVDVM2ImndvNAfq7xT7wIdn6:qdcBjDTZVM2Xn1KfiJ7w0n6
Threatray 388 similar samples on MalwareBazaar
TLSH CC84AC53AAF6ED33C6F136FF0058B5544E2E9EA00CE1B48676ACB905FEB7942D841583
Reporter abuse_ch
Tags:exe NetWire RAT


Avatar
abuse_ch
NetWire RAT C2:
goryhazel1.duckdns.org:6504

Intelligence

File Origin
# of uploads :
2
# of downloads :
386
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ATO-RELIEF.xlsm
Verdict:
Malicious activity
Analysis date:
2021-03-05 13:16:17 UTC
Tags:
macros macros-on-open generated-doc loader trojan netwire
Link:
https://app.any.run/tasks/593e1198-f8a5-441b-a05f-976a5c9002eb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Netwire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/122453/
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Unauthorized injection to a recently created process
Creating a window
DNS request
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/629753
Signature
Contains functionality to log keystrokes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Sigma detected: NetWire
Uses dynamic DNS services
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/31a804fddf5f1ed1d5c1a69772bc92026f90696a6903a3a7ebaf7aef6dfa9478/
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2021-03-05 13:00:11 UTC
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gguaj7o7l4pndvobu2lxfpesajxza2lkneb2hj7lv55o63p2sr4a._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
1c1035301c27d73a161ca96f9732f5024eb924798ce95d76d274b751ff87aa2f
NetWire
328908f054c4a82ebcb35127b0e9c7924dcdb6c134b76f01b269a2dd23967b18
NetWire
3434bb383c8dd721266f60e07820474205d70c5da9ebb465109ace7894567437
NetWire
87c89f29aaa5dd79839585af00f1d29fa406e18ee341b23aa08f471b8c096f8b
NetWire
90dbd6dce0e0e7013656333f1cd8a9b7660e0e40e782a622856800c52e980d3e
NetWire
bdfb906a3a02d8a28bef1d13d0abff090bc9582373e05e5f376186e9a7c5a902
NetWire
c2382986d2bacaacd5399abca6ba33ee39fec2e9f331b8493a7511bc23578adc
NetWire
f5c3a4c6e9a672d984b794977cac7cc5ce38b6ab3c76bb79227217cc432a6ad9
NetWire
f77b3b293e8f2218082419742b85c2156fe8c13353cec54ba021e26312d3698f
NetWire
fefea87ebfbd43c789033d46905fd2a11b8ea9d4c6b57691f23a89e8f8687992
NetWire
+ 378 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet rat stealer
Link:
https://tria.ge/reports/210305-qvhjeljlae/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
NetWire RAT payload
Netwire
Unpacked files
SH256 hash:
24af4063623c98e0f7a769a3d45bb4e2cec688cbab20f2217f10dd2616255d0e
MD5 hash:
f03a3d2a74a40577e0fd17089605e204
SHA1 hash:
b5e32b6792ac01ab485601d6f102c5b4345fb246
Detections:
win_netwire_g1
Create hunting rule
win_netwire_auto
Create hunting rule
Link:
https://www.unpac.me/results/59aec5c7-e55e-49b7-8f74-ba0b7e02e3f8/
Parent samples :
9fedb9fe35eae9739d319565aed4cbd16325242f8815cdf21d12d02e5601109d
bdfb906a3a02d8a28bef1d13d0abff090bc9582373e05e5f376186e9a7c5a902
31a804fddf5f1ed1d5c1a69772bc92026f90696a6903a3a7ebaf7aef6dfa9478
SH256 hash:
aa943e7b25d7f6062e5dab458a999330a93c51b057458c046c209ee0ad67bb56
MD5 hash:
349c8b28bf6f0c34029d507a81f593fe
SHA1 hash:
b50a29558eda0c492c06c49caef821dfac7f33e4
Link:
https://www.unpac.me/results/59aec5c7-e55e-49b7-8f74-ba0b7e02e3f8/
SH256 hash:
d81924db1830fbbda6aa3f060e1ce300c4b3a5d6f94bd6612014ab80e3b3e43c
MD5 hash:
cec9aa438d9bc2ff5d50f91b4976456a
SHA1 hash:
79f93e4d0c6fcd8d3eba089e4528899848679bbc
Link:
https://www.unpac.me/results/59aec5c7-e55e-49b7-8f74-ba0b7e02e3f8/
SH256 hash:
31a804fddf5f1ed1d5c1a69772bc92026f90696a6903a3a7ebaf7aef6dfa9478
MD5 hash:
307e257292be5d47304c1712c8bd1342
SHA1 hash:
b22e2b425e3a663f7404579ebf03507713b45959
Link:
https://www.unpac.me/results/59aec5c7-e55e-49b7-8f74-ba0b7e02e3f8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.47
Link:
https://yomi.yoroi.company/submissions/31a804fddf5f1ed1d5c1a69772bc92026f90696a6903a3a7ebaf7aef6dfa9478

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:MALWARE_Win_NetWire
Create hunting rule
Author:ditekSHen
Description:Detects NetWire RAT
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NetWire

Executable exe 31a804fddf5f1ed1d5c1a69772bc92026f90696a6903a3a7ebaf7aef6dfa9478

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/122453/
  
URLhaus
https://urlhaus.abuse.ch/url/1048606/
  
Delivery method
Distributed via web download

Comments