MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWalker


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf
SHA3-384 hash: 59ef76ef582808ce416d81c0210c7a6ecf4af2b863546de405b5e03c17b21b85ad5f3242948e82cce622a6fbe88b8a69
SHA1 hash: 0aa73a466c599b0b2c6e60f0aa0676b9bf6741c7
MD5 hash: 729928e6fd6adafdd0a7fe876701bd7e
humanhash: pip-november-edward-happy
File name:4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf
Download: download sample
Signature NetWalker
Create hunting rule
File size:70'656 bytes
First seen:2020-06-01 14:30:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e82dd51b077167be63c004bed23d0c1e (40 x NetWalker, 2 x GuLoader, 1 x ShikataGaNai)
ssdeep 1536:juCWRxL7hbUiQfovecnXUU+hhOZuIWiFp+ZfaBZebC33O+5Gnb:KCWf7VJQfmeMXvkhOZu1iFBBZebC3S
Threatray 57 similar samples on MalwareBazaar
TLSH 19635A83F682C2B0D98606F967FFF37E08725D14977589C3CB121C41E9399E2553A36A
Reporter Anonymous
Tags:NetWalker


Avatar
Anonymous
Zero2Automated Course

Intelligence

File Origin
# of uploads :
1
# of downloads :
2'037
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Ransomware.Netwalker-7671868-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Netwalker
Create hunting rule
Status:
Malicious
First seen:
2020-04-22 14:16:28 UTC
File Type:
PE (Exe)
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
162ae350c47c2e14864d0c0f927bf424eb6b844017329c9b1e216f3e2d724d98
NetWalker
22a5872ba6adfe449e46d9a223cb7567697e30f89d6d42095e48de3033359de3
NetWalker
27319e75c23693399977e92b9a7ba5680a7a9db448f93b3221840c61301604d5
NetWalker
352cd5d318e4cff15910dc70b609ef9bf1d1ee0b7f01e186bedb5e7d245e3ec6
NetWalker
444169e156b48a54e9f96b6b3a1c333670546663c8a2e14e561884c052420043
NetWalker
63ad8faf3c2b306ccd8aa7874e24e7d48e0f6bbeeb37adab26c2efa1410022c4
NetWalker
6bd34d33ccb47430751ae964ca56ec206da0fa3bdc5eb670fc54edf4c11629bc
NetWalker
ee531cd7011cb5c2625d40892b70cf7e3860dbb92648391068e1f340e5d6c47f
NetWalker
f2215e1a848bc5a5d172745201ea428b1d16fee7c814c5c5180a94a134592e86
NetWalker
fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913
NetWalker
+ 47 additional samples on MalwareBazaar
Result
Malware family:
netwalker
Create hunting rule
Score:
  10/10
Tags:
family:netwalker persistence ransomware spyware
Link:
https://tria.ge/reports/201109-11qy56ypya/
Behaviour
Interacts with shadow copies
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Modifies service
Deletes itself
Reads user/profile data of web browsers
Modifies extensions of user files
Deletes shadow copies
Netwalker Ransomware
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:netwalker_ransomware
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Netwalker ransomware
Reference:https://www.ccn-cert.cni.es/comunicacion-eventos/comunicados-ccn-cert/9802-publicado-un-informe-de-codigo-danino-sobre-netwalker.html

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NetWalker

Executable exe 4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/348179/
  
Delivery method
Distributed via web download

Comments