MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37dd9ac0253be5eb6036877963ff457db90932e34d9bbd2c18852bf8bfd873c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37dd9ac0253be5eb6036877963ff457db90932e34d9bbd2c18852bf8bfd873c2
SHA3-384 hash: 4cc6e44f90d1c53e7304ec3b4d95f87c9ec8ca410159cc6eaac80ea97cd1983a274ba3ea73efe1501b1fa3c3108aae2b
SHA1 hash: 5e2cce422118c0990f672aa94b3dfd0b7b7b677c
MD5 hash: bd860ed37f001dc94511398bcd30f7a2
humanhash: nuts-aspen-chicken-neptune
File name:37dd9ac0253be5eb6036877963ff457db90932e34d9bbd2c18852bf8bfd873c2
Download: download sample
Signature NetWire
Create hunting rule
File size:2'876'928 bytes
First seen:2020-06-10 12:10:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash afcdf79be1557326c854b6e20cb900a7 (1'102 x FormBook, 936 x AgentTesla, 399 x RemcosRAT)
ssdeep 49152:1h+ZkldoPK8YaWgOqpfrcyVO8CTDQzyJRXnB/e+iOqZ32GKPG8Gro:G2cPK8jJfYyVO8CTDQzsRXn5eIqBMG
Threatray 686 similar samples on MalwareBazaar
TLSH 21D50112B3D2D036FFAB92739B5AF20556BDB9240133852F13982D79BD701B1227E663
Reporter JAMESWT_WT
Tags:NetWire

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 01:13:39 UTC
File Type:
PE (Exe)
Extracted files:
8
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g7ozvqbfhps6wybwq54wh72fpw4qsmxdjwn32layquv7rp6yopba._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
05b449bf4042b771a25d8d1b850e942325516196b73aba7a70e99f80b996ab2c
NetWire
1ee9fb4b4fe961356a3cd18396eb377bb831952e0a4e48c0e8e9866cda850c97
NetWire
2b554ef8cede0aaf90b2eba967599dede6795344ae5c7e876e5c3a5776894a16
NetWire
4b5a4437b8b7bab10cfb32c06b5241f92b3a2e2861f56190b8b17a7028ec64c8
NetWire
5a6ec33655b094adad729342ca628d990053825ee805d99a4e0b6108b5047e51
NetWire
788439bb46a147272e39cdd6a8a8ecdc68dbb3317e4d058526d6feda09d64613
NetWire
894061c993db2acb055ccd2f85468e1f18af0dff041c48c6f0851bf072efb31f
NetWire
a93a71cdc90f1ab2f2c80db6f0c55b95f43bad13faff06c89f2c728cab630773
NetWire
c2a69374fa77ae7fa54914c3ae95f0741ca0a17b09550f95afeed9303e2aa76a
NetWire
cf59115a8711130953d2ff02b54b9aab6fd1dfd3a485eb8b1b36c687d8c855c6
NetWire
+ 676 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet persistence rat stealer
Link:
https://tria.ge/reports/201109-a568cnp6e6/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
NetWire RAT payload
Netwire
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Malicious_BAT_Strings
Create hunting rule
Author:Florian Roth
Description:Detects a string also used in Netwire RAT auxilliary
Reference:https://pastebin.com/8qaiyPxs
Rule name:MAL_unspecified_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects unspecified malware sample
Reference:Internal Research
Rule name:netwire
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect netwire in memory
Reference:internal research
Rule name:Suspicious_BAT_Strings
Create hunting rule
Author:Florian Roth
Description:Detects a string also used in Netwire RAT auxilliary
Reference:https://pastebin.com/8qaiyPxs
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments