MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ffc5daa049116311ac1363623b7a8960b7aabb4b874d1126a358b8d483e33cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 10

Intelligence 10 IOCs YARA 4 File information Comments

SHA256 hash:	3ffc5daa049116311ac1363623b7a8960b7aabb4b874d1126a358b8d483e33cd
SHA3-384 hash:	e6a0b728050c157075c3852e808358d05500b91624807262a8bf8f9db61effaef57b957ad5643148ec0721d91f381427
SHA1 hash:	88748e375d0bf0d588b633c8ba815d34f3edea19
MD5 hash:	18ae9c064e66cc5fe426dbeaec3ed2d6
humanhash:	massachusetts-kilo-idaho-speaker
File name:	Document.exe
Download:	download sample
Signature	NetWire Create hunting rule
File size:	753'664 bytes
First seen:	2021-03-09 15:00:45 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0c4ee73e2314625013995d8fcbbc1e29 (3 x Formbook, 2 x NetWire, 1 x Loki)
ssdeep	12288:4WvotGuCXzMfmdGec+DWs26KD/pxgEqsMFfD6STyl:4WvIEym4yZepRkD6STy
Threatray	393 similar samples on MalwareBazaar
TLSH	43F4BF33D2E06877C1731B7D6E2B439D952ABD103B39AD861AD52D885FBBBC03815287
Reporter	abuse_ch
Tags:	DHL exe NetWire OVPN RAT

abuse_ch

Malspam distributing NetWire:

HELO: mail.issuedhl.com
Sending IP: 5.206.224.221
From: Dhl Customer Support <help@issuedhl.com>
Subject: Delivery Failed
Attachment: Attached file.iso (contains "Document.exe")

NetWire RAT C2:
legend.casacam.net:6655

Intelligence

File Origin

# of uploads :

# of downloads :

403

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Document.exe

Verdict:

Malicious activity

Analysis date:

2021-03-09 15:04:16 UTC

Tags:

rat netwire trojan

Link:

https://app.any.run/tasks/bb82294e-98c4-4a79-bae6-fd93567b6e2d

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/123266/

Detection(s):

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

DNS request

Sending a custom TCP request

Creating a file

Deleting a recently created file

Launching a process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a system process

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

NetWire

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/633024

Signature

Allocates memory in foreign processes

Contains functionality to log keystrokes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Internet Explorer form passwords

Creates a thread in another existing process (thread injection)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sigma detected: NetWire

Writes to foreign memory regions

Yara detected NetWire RAT

Behaviour

Behavior Graph:

Download SVG

Gathering data

Threat name:

Win32.Infostealer.Fareit

Status:

Malicious

First seen:

2021-03-09 15:01:12 UTC

AV detection:

18 of 47 (38.30%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=h76f3kqeseldcgwbgy3chn5isyfxvk5uxb2ncetkgwfy2sb6gpgq._file

Verdict:

malicious

Label(s):

netwirerc

Result

Malware family:

netwire

Score:

10/10

Tags:

family:netwire botnet persistence stealer

Link:

https://tria.ge/reports/210309-j3t659s33n/

Behaviour

Suspicious use of WriteProcessMemory

Adds Run key to start application

Blocklisted process makes network request

Netwire

Unpacked files

SH256 hash:

6cf97407564758a89313c781f003b69f85db94e608e0d1814da724c4e3917530

MD5 hash:

86d444f389003fb10ff0a4bec5e0f46f

SHA1 hash:

ecdb825b2aec46da313937e54e384a61ed1394cb

Link:

https://www.unpac.me/results/e757ecb4-59bb-40a5-8fec-fb3572bcf4f3/

SH256 hash:

3ffc5daa049116311ac1363623b7a8960b7aabb4b874d1126a358b8d483e33cd

MD5 hash:

18ae9c064e66cc5fe426dbeaec3ed2d6

SHA1 hash:

88748e375d0bf0d588b633c8ba815d34f3edea19

Link:

https://www.unpac.me/results/e757ecb4-59bb-40a5-8fec-fb3572bcf4f3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3ffc5daa049116311ac1363623b7a8960b7aabb4b874d1126a358b8d483e33cd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	APT_ArtraDownloader2_Aug19_1 Create hunting rule
Author:	Florian Roth
Description:	Detects ArtraDownloader malware
Reference:	https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	MALWARE_Win_NetWire Create hunting rule
Author:	ditekSHen
Description:	Detects NetWire RAT

Rule name:	win_netwire_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator