MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43ff3fea39b1e9ca2ebc2f714057bb50d14b4c76d46e31ee58ada74ded595eed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43ff3fea39b1e9ca2ebc2f714057bb50d14b4c76d46e31ee58ada74ded595eed
SHA3-384 hash: 95e973d01464be35f79c9df1d05b507c61653a62983277b0a113b9be44227a2d62957b27491dbdd5c415a61f85fb20b4
SHA1 hash: 70c1118d216adb364d1779f429bb74f62b02e625
MD5 hash: e379f065a86da6a2a18d295e6c761567
humanhash: seven-december-sierra-blue
File name:Payment Confirmation_PDF.scr
Download: download sample
Signature NetWire
Create hunting rule
File size:3'487'744 bytes
First seen:2020-08-14 10:11:20 UTC
Last seen:2020-08-14 11:01:58 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 98304:r0vVZRS4k8Y/Do6bMwwnNKNooQoCIhQcBcm2:r0vVZRS4k8Y/Dydo8
Threatray 6 similar samples on MalwareBazaar
TLSH A6F55C66BC43729BF84704F00EC6D5E4B1EE352902B05A29AD53192EF90DE573CCE9B6
Reporter abuse_ch
Tags:NetWire RAT scr


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: sharedmail4.securehostdns.com
Sending IP: 202.66.173.169
From: NUTECH POLYMERS PVT. LTD <marketing@nutechpolymers.com>
Reply-To: result@hkcostarn.com
Subject: Payment Confirmation Clarification
Attachment: Payment Confirmation_PDF.img (contains "Payment Confirmation_PDF.scr")

NetWire RAT C2:
alkaline.publicvm.com:1777 (198.23.213.38)

Intelligence

File Origin
# of uploads :
2
# of downloads :
301
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45786/
Detection(s):
SecuriteInfo.com.Generic.mg.e379f065a86da6a2.4272.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching a process
Using the Windows Management Instrumentation requests
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun
Enabling autorun by creating a file
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/429373
Signature
Binary contains a suspicious time stamp
Creates an undocumented autostart registry key
Disables Windows Defender (via service or powershell)
Drops PE files to the startup folder
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 267166 Sample: Payment Confirmation_PDF.scr Startdate: 16/08/2020 Architecture: WINDOWS Score: 84 43 Yara detected NetWire RAT 2->43 45 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 2->45 47 Machine Learning detection for sample 2->47 49 6 other signatures 2->49 7 Payment Confirmation_PDF.exe 3 4 2->7         started        11 Payment Confirmation_PDF.exe 2->11         started        13 Payment Confirmation_PDF.exe 2->13         started        process3 file4 37 C:\Users\...\Payment Confirmation_PDF.exe, PE32 7->37 dropped 39 Payment Confirmati...exe:Zone.Identifier, ASCII 7->39 dropped 41 C:\Users\...\Payment Confirmation_PDF.exe.log, ASCII 7->41 dropped 51 Creates an undocumented autostart registry key 7->51 53 Disables Windows Defender (via service or powershell) 7->53 15 powershell.exe 25 7->15         started        17 powershell.exe 23 7->17         started        19 powershell.exe 7->19         started        21 11 other processes 7->21 signatures5 process6 process7 23 conhost.exe 15->23         started        25 conhost.exe 17->25         started        27 conhost.exe 19->27         started        29 conhost.exe 21->29         started        31 conhost.exe 21->31         started        33 conhost.exe 21->33         started        35 8 other processes 21->35
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/43ff3fea39b1e9ca2ebc2f714057bb50d14b4c76d46e31ee58ada74ded595eed/
Threat name:
ByteCode-MSIL.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 10:13:06 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ip7t72rzwhu4ulv4f5yuav53kdiuwtdw2rxdd3syvwtu33kzl3wq._file
Verdict:
malicious
Similar samples:
0d5a1c4bba8bc36879548a2a75bbd81573f9188cc99d414a2d81f2cb7bf75218
NetWire
cea8cae444dd5dadf01c31def4681b170907b97e0cfb468a9ff317ce7ae736a3
NetWire
d7e75a0a8afcbc738cf4d9664ea6eb05f2ff4bd449efb042e2f7ab5ea6d68ce4
NetWire
e1a09abd8db2b63d25745d5ffb89ed1f0a275d525c4f0350f65f6e2c128b8477
NetWire
e8527d7fa32591fe8781401e694edab0e8bcfdb12452e752caacd17c2432f9d2
NetWire
ed7c4062eb467dd8fa195a179d6c151700d4f90ea326c66a4a2411ea9ddd2e7f
NetWire
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
rat persistence evasion trojan botnet stealer family:netwire
Link:
https://tria.ge/reports/200814-hevxdgsdea/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Maps connected drives based on registry
Checks BIOS information in registry
Drops startup file
Windows security modification
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Modifies WinLogon for persistence
Modifies Windows Defender Real-time Protection settings
NetWire RAT payload
Netwire
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/43ff3fea39b1e9ca2ebc2f714057bb50d14b4c76d46e31ee58ada74ded595eed

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

img aba0f23ae3b752463217cbe7b2a9fe5657c88efb740bb42bedd8acb1ddc1028f

NetWire

Executable exe 43ff3fea39b1e9ca2ebc2f714057bb50d14b4c76d46e31ee58ada74ded595eed

(this sample)

  
Dropped by
MD5 4df0f5f47b53a43078dfeedb91c833df
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/45786/
  
Dropped by
SHA256 aba0f23ae3b752463217cbe7b2a9fe5657c88efb740bb42bedd8acb1ddc1028f

Comments