MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45fd025d4d7964439d08a932823955f802f0e3932bcc8ed7d5db13b565007e1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45fd025d4d7964439d08a932823955f802f0e3932bcc8ed7d5db13b565007e1e
SHA3-384 hash: b1f37339a27291251d2ed318de4e6533f35fe1c206465df9b23cdcec3e7d71debb23b6792a6f9574246b45c6feea5661
SHA1 hash: 1aba0c8cbee90cc655ccf8a0bdadf6ba6c961bce
MD5 hash: 4275713c47a8448a5f8a131775cf5c8b
humanhash: white-blue-eighteen-pasta
File name:imegess.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:426'978 bytes
First seen:2022-03-15 06:21:27 UTC
Last seen:2022-03-15 07:53:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 6144:JGimzhkas0173Jb0qL4nbiRZaKMfmZjrDaQZ1YtSxb96NjJiZECIh:y173SEabizaKQir+Mwib96NcE1h
Threatray 52 similar samples on MalwareBazaar
TLSH T1A794DF629982E95ACD25C874D52BD7F5936A2C0DCD4263070326FC5A37FF2E3C96A407
File icon (PE):PE icon
dhash icon 2258a4a4aeaac50d (3 x NetWire, 1 x QuasarRAT)
Reporter abuse_ch
Tags:exe NetWire RAT


Avatar
abuse_ch
NetWire C2:
185.202.175.82:5000

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.202.175.82:5000 https://threatfox.abuse.ch/ioc/395315/

Intelligence

File Origin
# of uploads :
2
# of downloads :
370
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
netwire
Create hunting rule
ID:
1
File name:
imegess.exe
Verdict:
Malicious activity
Analysis date:
2022-03-15 06:41:22 UTC
Tags:
installer trojan rat netwire
Link:
https://app.any.run/tasks/bb0163ba-f774-457d-8247-cd43a42c1033

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
NetWire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/250554/
Detection(s):
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.12090.8545.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/6230308fdfdfa8501ca23d3f/reports/a55d0918-1dfd-452c-88e9-be5016a143d2/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
NetWire RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/77340337-421b-4b24-851b-e2a017a3f511
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/956723
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to steal Chrome passwords or cookies
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Sigma detected: NetWire RAT Registry Key
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 589204 Sample: imegess.exe Startdate: 15/03/2022 Architecture: WINDOWS Score: 96 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 Antivirus detection for URL or domain 2->42 44 4 other signatures 2->44 7 imegess.exe 18 2->7         started        10 usckxtjwhxnjp.exe 2->10         started        12 usckxtjwhxnjp.exe 2->12         started        process3 file4 30 C:\Users\user\AppData\...\byiakuebzj.exe, PE32 7->30 dropped 14 byiakuebzj.exe 1 2 7->14         started        18 WerFault.exe 10 10->18         started        21 WerFault.exe 10->21         started        23 WerFault.exe 3 10 12->23         started        25 WerFault.exe 12->25         started        process5 dnsIp6 32 C:\Users\user\AppData\...\usckxtjwhxnjp.exe, PE32 14->32 dropped 46 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 14->46 48 Contains functionality to steal Chrome passwords or cookies 14->48 50 Injects a PE file into a foreign processes 14->50 27 byiakuebzj.exe 2 14->27         started        34 192.168.2.1 unknown unknown 18->34 file7 signatures8 process9 dnsIp10 36 185.202.175.82, 49756, 5000 UNREAL-SERVERSUS Netherlands 27->36
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45fd025d4d7964439d08a932823955f802f0e3932bcc8ed7d5db13b565007e1e/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-03-15 06:22:14 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ix6qexknpfsehhiivezieokv7abpby4tfpgi5v6v3mj3kziapypa._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
818bed3da07ea9e48989e4d61e6190df849ada635bfdc53ce86544a2deaa8ef0
NetWire
9b697bd07f78c00751511ba619ba1a018d3628378d7e2d6c7ba35ceb9e99cac4
NetWire
a5552237bf0ede9675b646aea11141c7763ed882fc8dbfe1b036f6347fe98ad3
NetWire
e4715658b6981b37c06e063e6b59af6d82c8c5edeb93e339e367d497332b7b69
NetWire
e83b81147f0b08a09751772c75cdec2522f2fce19b1f035a2ddc415f633dd2e0
NetWire
ec151e8b6c21fa0d0ed0550629a8421c797635dcdc8662454c37e3f25a41e9f1
NetWire
+ 42 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet persistence rat stealer
Link:
https://tria.ge/reports/220315-g4x2rsgea8/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
NetWire RAT payload
Netwire
Malware Config
C2 Extraction:
185.202.175.82:5000
Unpacked files
SH256 hash:
45fd025d4d7964439d08a932823955f802f0e3932bcc8ed7d5db13b565007e1e
MD5 hash:
4275713c47a8448a5f8a131775cf5c8b
SHA1 hash:
1aba0c8cbee90cc655ccf8a0bdadf6ba6c961bce
Link:
https://www.unpac.me/results/880a9f79-6002-471b-9666-ca7a6524da05/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.68
Link:
https://yomi.yoroi.company/submissions/45fd025d4d7964439d08a932823955f802f0e3932bcc8ed7d5db13b565007e1e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:MALWARE_Win_NetWire
Create hunting rule
Author:ditekSHen
Description:Detects NetWire RAT
Rule name:MAL_unspecified_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects unspecified malware sample
Reference:Internal Research
Rule name:MAL_unspecified_Jan18_1_RID2F4A
Create hunting rule
Author:Florian Roth
Description:Detects unspecified malware sample
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/250554/

Comments