MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41dbe67f8521046283d43077e26d6fef8a830e94f6ad1b1765dc5056f8d81846. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 9

Intelligence 9 IOCs YARA 7 File information Comments

SHA256 hash:	41dbe67f8521046283d43077e26d6fef8a830e94f6ad1b1765dc5056f8d81846
SHA3-384 hash:	01ca1bdda5dd700d4a15419c9c827130fbd3dff1ef32ac1c413c98d7083860c906cc39fa5c331aed36e8100d5d866661
SHA1 hash:	33f0a12a80b686159822fce665422546a49348b5
MD5 hash:	fe640ee4067329f2713d5c2ecc63ab9f
humanhash:	september-carbon-shade-september
File name:	Payment notification.exe
Download:	download sample
Signature	NetWire Create hunting rule
File size:	832'512 bytes
First seen:	2021-01-14 07:02:57 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	12288:hA+qpGxzLpb67gXzHR3q/v1PfOwMtxEatzYmsyPs86Lqv0O3B6EsGmZAWsmDG9k7:k+ZWWzHR3q/dXct2CY0Oq8Ss
Threatray	1 similar samples on MalwareBazaar
TLSH	7305C557A904978FE43586B9BE430F6C6F193E1DA5C666EF40230D8B7A383724D4E06E
Reporter	abuse_ch
Tags:	exe NetWire RAT

abuse_ch

Malspam distributing NetWire:

HELO: smtp.hugedns.co.za
Sending IP: 102.67.140.104
From: Payment@capitecbank.co.za
Reply-To: No-reply@capitecbank.co.za
Subject: Payment Notification
Attachment: Payment notification.img (contains "Payment notification.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

308

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Payment notification.exe

Verdict:

Malicious activity

Analysis date:

2021-01-14 07:20:27 UTC

Tags:

rat netwire trojan

Link:

https://app.any.run/tasks/bfeada77-40c8-4df0-a588-a415fb91b578

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/111961/

Detection(s):

SecuriteInfo.com.Trojan.Siggen11.57608.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Unauthorized injection to a recently created process

Creating a file

Sending a TCP request to an infection source

Enabling autorun by creating a file

Result

Threat name:

NetWire

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/581149

Signature

Contains functionality to steal Chrome passwords or cookies

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NetWire

Sigma detected: Scheduled temp file as task from temp location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM_3

Yara detected NetWire RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/41dbe67f8521046283d43077e26d6fef8a830e94f6ad1b1765dc5056f8d81846/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2021-01-14 07:03:32 UTC

AV detection:

13 of 44 (29.55%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ihn6m74feecgfa6ugb36e3lp56figduu62wrwf3f3rifn6gydbda._file

Verdict:

unknown

NetWire

Result

Malware family:

netwire

Score:

10/10

Tags:

family:netwire botnet rat stealer

Link:

https://tria.ge/reports/210114-13bbwdre52/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

NetWire RAT payload

Netwire

Unpacked files

SH256 hash:

41dbe67f8521046283d43077e26d6fef8a830e94f6ad1b1765dc5056f8d81846

MD5 hash:

fe640ee4067329f2713d5c2ecc63ab9f

SHA1 hash:

33f0a12a80b686159822fce665422546a49348b5

Link:

https://www.unpac.me/results/9e37cffd-b4bc-4f8f-9e2a-ccb8689348cb/

SH256 hash:

64a419709ad219ffc006bda776b650da486d55048d2fa34525f40227da0e5c86

MD5 hash:

88c0ec8398978fa2e4240f02765086ad

SHA1 hash:

5a5c4935b2d70e890c89ad9332365f4f4aa86f3c

Link:

https://www.unpac.me/results/9e37cffd-b4bc-4f8f-9e2a-ccb8689348cb/

SH256 hash:

a4fe7191b7d100a2fbd32aac439154e528607f73ed29fd56825d7048ffbccaf3

MD5 hash:

8a8c5b219962d6329a543a392eb50d6b

SHA1 hash:

a084ab4b28a6c2a7a8b9f6e84202abd1122aca81

Detections:

win_netwire_g1

win_netwire_auto

Link:

https://www.unpac.me/results/9e37cffd-b4bc-4f8f-9e2a-ccb8689348cb/

Parent samples :

41dbe67f8521046283d43077e26d6fef8a830e94f6ad1b1765dc5056f8d81846
2dc1258101b1183ad4e08320f15310cad541c900919e98e0816c751fee303306
ef9e50bbc71c2f7c213f49e413cebab25733d52f82f2197ab256471ecb3db3bf
842a7bdd501965dc3ce327604d73374aa1c392ce2a151fc55561e42782ea30f2

SH256 hash:

2498424bb4f5040468b43e0cac755cafc29e06c872be1f24c13ec36640e6130d

MD5 hash:

edcc13a16b3e19241cf7b685dc4a805f

SHA1 hash:

b9a5950ebf5b6146074ae2f7b6c61b3f35397477

Link:

https://www.unpac.me/results/9e37cffd-b4bc-4f8f-9e2a-ccb8689348cb/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/41dbe67f8521046283d43077e26d6fef8a830e94f6ad1b1765dc5056f8d81846

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	IPPort_combo_mem Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	Malicious_BAT_Strings Create hunting rule
Author:	Florian Roth
Description:	Detects a string also used in Netwire RAT auxilliary
Reference:	https://pastebin.com/8qaiyPxs

Rule name:	MAL_unspecified_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects unspecified malware sample
Reference:	Internal Research

Rule name:	netwire Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect netwire in memory
Reference:	internal research

Rule name:	Suspicious_BAT_Strings Create hunting rule
Author:	Florian Roth
Description:	Detects a string also used in Netwire RAT auxilliary
Reference:	https://pastebin.com/8qaiyPxs

Rule name:	win_netwire_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator