MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41d5aea6b867aa646afd31168f8b4ba49bfc84930ee95969ad05035c0b6360cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	41d5aea6b867aa646afd31168f8b4ba49bfc84930ee95969ad05035c0b6360cc
SHA3-384 hash:	23584d49b011763bf07010126b2607a9b209e781958137a8a77c45f7ef930a59caa3249778e1bf5eb47094440fd08217
SHA1 hash:	e0348716672ba482ecd6aa3509ea4121f4556798
MD5 hash:	eeb75d5d480c1e555511394ec3580f1c
humanhash:	mississippi-hawaii-oregon-diet
File name:	Order0001.xls
Download:	download sample
Signature	NetWire Create hunting rule
File size:	440'320 bytes
First seen:	2020-08-27 07:30:10 UTC
Last seen:	Never
File type:	xls
MIME type:	application/vnd.ms-excel
ssdeep	6144:zxEtjPOtioVjDGUU1qfDlavx+W+LIfdAkxSxprUSz3TJwZWQa7MpHldrJNsMqIDg:OxSnlDCZWVgKMlQlon7UGD1uE+W9S2/C
TLSH	4B94122630928AF7C52713B949E585F93A0FDD232F5743F72208B369DBB16D049C26DA
Reporter	abuse_ch
Tags:	NetWire nVpn RAT xls

abuse_ch

Malspam distributing NetWire:

HELO: host.surmiweb.com
Sending IP: 67.222.12.106
From: Loreta Rosado <smtpfox-urezq@aryatechno.com>
Reply-To: Loreta Rosado <jamesb080@vivaldi.net>
Subject: Request for Quotation
Attachment: Order0001.xls

NetWire RAT payload URL:
http://77.73.69.79/wozg/Lime_Host.exe

NetWire RAT C2:
pre08080.nsupdate.info:4770 (185.140.53.178)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU3
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-07-28T20:56:03Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

265

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.POWERSHELL.EXE.200327.UNOFFICIAL

TwinWave.EvilDoc.Excel4HTTPSplitSoPhysical.202000615.UNOFFICIAL

TwinWave.EvilDoc.Excel4Macro.HiddenSheetDLWAKEUP.20200310.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a process with a hidden window

Launching a process by exploiting the app vulnerability

Result

Threat name:

Hidden Macro 4.0

Detection:

malicious

Classification:

expl.evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/452333

Signature

Connects to a URL shortener service

Document exploit detected (process start blacklist hit)

Found Excel 4.0 Macro with suspicious formulas

Multi AV Scanner detection for submitted file

Obfuscated command line found

Sigma detected: Microsoft Office Product Spawning Windows Shell

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/41d5aea6b867aa646afd31168f8b4ba49bfc84930ee95969ad05035c0b6360cc/

Threat name:

Document-Excel.Trojan.NetWired

Status:

Malicious

First seen:

2020-08-27 07:32:06 UTC

AV detection:

15 of 29 (51.72%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ihk25jvym6vgi2x5geli7c2lusn7zbetb3uvs2nnaubvyc3dmdga._file

Result

Malware family:

n/a

Score:

8/10

Tags:

macro

Link:

https://tria.ge/reports/200827-4gafs3f2wa/

Behaviour

Suspicious Office macro

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Trojan

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/41d5aea6b867aa646afd31168f8b4ba49bfc84930ee95969ad05035c0b6360cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.