MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3adeefdaffda88ac8183d5c4164c9ad10b63c039c72fac187a596f4fcf906c00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 14

Intelligence 14 IOCs 1 YARA 5 File information Comments

SHA256 hash:	3adeefdaffda88ac8183d5c4164c9ad10b63c039c72fac187a596f4fcf906c00
SHA3-384 hash:	3c445611668241ded07d0c75fbde55ee52bfc01d5aae8bca3c433746c3c5f827c1605ab58b67ccb6230b3eb71274ce9a
SHA1 hash:	1bef5e61a3c11a8651870f3ad386f0a09f94de52
MD5 hash:	8f98297f190db64c6c1bb9b85b78eca5
humanhash:	spaghetti-alanine-sodium-december
File name:	8f98297f190db64c6c1bb9b85b78eca5.exe
Download:	download sample
Signature	NetWire Create hunting rule
File size:	280'064 bytes
First seen:	2022-08-02 17:46:01 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e03c5ea8e25367650e1f4380ec0a6eaf (8 x NetWire)
ssdeep	6144:ebhnot4+sbOAtbkfHLDiT6OzR8Q0l+/NyqRKbhoXqqD8Xw8B:elnot4+UwLDiT6OzR8llAgqSB
Threatray	71 similar samples on MalwareBazaar
TLSH	T1D654BF42F982C073DA961972047BEB7A493E65384F30DAD797901CB9EE213C0EA35B5D
TrID	40.3% (.EXE) Win64 Executable (generic) (10523/12/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4505/5/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	abuse_ch
Tags:	exe NetWire RAT

abuse_ch

NetWire C2:
107.182.129.65:3677

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
107.182.129.65:3677	https://threatfox.abuse.ch/ioc/841153/

Intelligence

File Origin

# of uploads :

# of downloads :

377

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

netwire

ID:

File name:

8f98297f190db64c6c1bb9b85b78eca5.exe

Verdict:

Malicious activity

Analysis date:

2022-08-03 06:29:37 UTC

Tags:

trojan rat netwire

Link:

https://app.any.run/tasks/3604532e-ac1b-48f4-bbb0-da3d2e2d3e0e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

NetWire

Link:

https://www.capesandbox.com/analysis/295958/

Detection(s):

Win.Dropper.NetWire-9951935-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Creating a file in the %AppData% subdirectories

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

cmd.exe evasive greyware keylogger shell32.dll

Link:

https://www.filescan.io/uploads/62e963576336465f2a06a5ed/reports/799e1fcd-5292-43b2-87bb-9a5a99c1fdd6/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/daf98ba1-ca8c-48d8-9307-65819798ca74

Result

Threat name:

NetWire

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1045193

Signature

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Internet Explorer form passwords

Found evasive API chain (may stop execution after checking mutex)

Found stalling execution ending in API Sleep call

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to harvest and steal browser information (history, passwords, etc)

Uses dynamic DNS services

Yara detected NetWire RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3adeefdaffda88ac8183d5c4164c9ad10b63c039c72fac187a596f4fcf906c00/

Threat name:

Win32.Backdoor.NetWired

Status:

Malicious

First seen:

2022-08-02 06:46:44 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

24 of 26 (92.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hlpo7wx73kekzamd2xcbmte22efwhqbzy4x2ygd2lfxu7t4qnqaa._file

Verdict:

malicious

Label(s):

netwirerc

NetWire

74cb2165665a7f5c4c42bb4cf20433469f8d3a05b46967658440324aa811a9d7

NetWire

9754284c45e7c6b119c5d377df3679f88ec3e753390d0f43980b22673302b059

NetWire

a40bd62eff582a81334bd53c21ea4ef288fca54d97c4ccff59dd8d607786ea78

NetWire

b378ec0bf6c23b5896a942d12f8cdd915e8cc4d5ca3bc1886334bfb8ae642102

NetWire

cbaa4d9ea4ecb2daeb67d06f2a7a168394ee602a9af19ac88b5e4fe44018f999

NetWire

d49ae415cb86861a5dda7254a78dc8a2f68b4976e92cb3c5a62584c33375bdeb

NetWire

d60219d448eb46ada30fb1edcba7067602d7f99bdee66d9556ab96706ea33c2d

NetWire

e648b2635ab2a0370a40f6aa6b8993b566d21843a775808a4bd63cac3fe8614b

NetWire

+ 61 additional samples on MalwareBazaar

Result

Malware family:

netwire

Score:

10/10

Tags:

family:netwire botnet persistence rat spyware stealer upx

Link:

https://tria.ge/reports/220802-wcajqaafhr/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Adds Run key to start application

Loads dropped DLL

Reads user/profile data of web browsers

UPX packed file

ACProtect 1.3x - 1.4x DLL software

Netwire

Malware Config

C2 Extraction:

ponchikvps.ddns.net:3677

Unpacked files

SH256 hash:

3adeefdaffda88ac8183d5c4164c9ad10b63c039c72fac187a596f4fcf906c00

MD5 hash:

8f98297f190db64c6c1bb9b85b78eca5

SHA1 hash:

1bef5e61a3c11a8651870f3ad386f0a09f94de52

Detections:

win_netwire_g1

Link:

https://www.unpac.me/results/6f6ea52e-ee19-43e2-8c95-386c83c67223/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3adeefdaffda88ac8183d5c4164c9ad10b63c039c72fac187a596f4fcf906c00

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	MALWARE_Win_NetWire Create hunting rule
Author:	ditekSHen
Description:	Detects NetWire RAT

Rule name:	MAL_unspecified_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects unspecified malware sample
Reference:	Internal Research

Rule name:	MAL_unspecified_Jan18_1_RID2F4A Create hunting rule
Author:	Florian Roth
Description:	Detects unspecified malware sample
Reference:	Internal Research