MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4bb5887d12b822628da418c65c8999b402dd262a58f4ee133a51f00a0c9e7881. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 9


Intelligence 9 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4bb5887d12b822628da418c65c8999b402dd262a58f4ee133a51f00a0c9e7881
SHA3-384 hash: d32f91bda19081f7ac2253337a649dde1a367fd87e16a60582e03335417f3cf4e9a1494b44f00cf197ff1ac24bd18200
SHA1 hash: 8bbff31f56028c52f80a71e32db592f649719dde
MD5 hash: b22d935b3a03752f85d65b6e5d57d80f
humanhash: triple-avocado-mango-wyoming
File name:Document.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:721'368 bytes
First seen:2021-05-27 18:53:19 UTC
Last seen:2021-05-27 20:19:29 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 3e7272567bf6719a2a90dbca5f3a4b3a (1 x Loki, 1 x NetWire, 1 x BitRAT)
ssdeep 12288:wuxGeRhWzrlZe7q6OWA50P3TaD8vVKlWFn+yGMBNyE:wyHWzrsOWxjQfEbyE
Threatray 238 similar samples on MalwareBazaar
TLSH 81E49E22F2D105F6D05A5E385C1B96549978BEB03D246CAA37F43D48AEBE3803D2D9D3
Reporter abuse_ch
Tags:exe NetWire RAT


Avatar
abuse_ch
NetWire C2:
217.64.149.117:6655

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
217.64.149.117:6655 https://threatfox.abuse.ch/ioc/65673/

Intelligence

File Origin
# of uploads :
2
# of downloads :
368
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Document.exe
Verdict:
Malicious activity
Analysis date:
2021-05-27 20:40:06 UTC
Tags:
installer
Link:
https://app.any.run/tasks/e6bd0452-7fea-45d0-9d06-01b75e86c627

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
NetWire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/162832/
Detection(s):
PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
DNS request
Sending a custom TCP request
Creating a file
Deleting a recently created file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/793407
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Internet Explorer form passwords
Creates a thread in another existing process (thread injection)
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Writes to foreign memory regions
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 425805 Sample: Document.exe Startdate: 27/05/2021 Architecture: WINDOWS Score: 100 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 7 other signatures 2->53 6 Alaiom.exe 16 2->6         started        10 Alaiom.exe 16 2->10         started        12 Document.exe 1 19 2->12         started        process3 dnsIp4 25 192.168.2.1 unknown unknown 6->25 27 zpohla.ch.files.1drv.com 6->27 33 2 other IPs or domains 6->33 55 Multi AV Scanner detection for dropped file 6->55 57 Machine Learning detection for dropped file 6->57 59 Writes to foreign memory regions 6->59 15 mshta.exe 6->15         started        29 zpohla.ch.files.1drv.com 10->29 35 2 other IPs or domains 10->35 61 Allocates memory in foreign processes 10->61 63 Creates a thread in another existing process (thread injection) 10->63 65 Injects a PE file into a foreign processes 10->65 19 DpiScaling.exe 10->19         started        31 zpohla.ch.files.1drv.com 12->31 37 2 other IPs or domains 12->37 23 C:\Users\Public\Alaiom\Alaiom.exe, PE32 12->23 dropped 21 ieinstal.exe 2 12->21         started        file5 signatures6 process7 dnsIp8 41 Contains functionality to log keystrokes 15->41 43 Contains functionality to steal Internet Explorer form passwords 15->43 45 Contains functionality to steal Chrome passwords or cookies 15->45 39 Lindron10.casacam.net 217.64.149.117, 49713, 49725, 49726 OBE-EUROPEObenetworkEuropeSE Sweden 21->39 signatures9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4bb5887d12b822628da418c65c8999b402dd262a58f4ee133a51f00a0c9e7881/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-05-27 18:54:10 UTC
AV detection:
18 of 47 (38.30%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jo2yq7isxargfdnedddfzcmzwqbn2jrkld2o4ez2khyaude6pcaq._file
Verdict:
malicious
Similar samples:
028fb2b55806708dc61ab34ad360998449e5710eca9d0f85cae4987c6144acf6
NetWire
29579f8372f95ea79bff6b28fd59625b3acb14797216742d93a110b3fa950d40
NetWire
4eec9ac382b6fcbf861641137d9a597a04a891a47983252137a7b0fdbbeb842b
NetWire
5d9d8df653e49a9bda60668f00988aa638e3825b8c4153363f689422a8396e3b
NetWire
604a7c2d1362f5bf1f7258b0e3f7d946f629de3f52155c1ae6b6bf6ba661f95d
NetWire
74ff69d2acffcbe2ed4ad76db8c1025be066170a8cc5b7c7048ea8cdcb155179
NetWire
a99a40d67018df27d1c4a0aad6b77a5985ab161480459060d5485976e70aae85
NetWire
ab99527876af2a4f02542bd2eda871142f23eedb4b344f3b227f87657bbf2104
NetWire
d04efc1f583b9d7a2f2e600a43eeb8fb8359432c591a4f8cc583caf881097421
NetWire
ddf9f373e5735daeaea928c67bf342b9a71089ef06b4b9ec4fd8f593f34969e0
NetWire
+ 228 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/210527-6n819eb2lx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Adds Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4bb5887d12b822628da418c65c8999b402dd262a58f4ee133a51f00a0c9e7881

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_ArtraDownloader2_Aug19_1
Create hunting rule
Author:Florian Roth
Description:Detects ArtraDownloader malware
Reference:https://unit42.paloaltonetworks.com/multiple-artradownloader-variants-used-by-bitter-to-target-pakistan/
Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:MALWARE_Win_NetWire
Create hunting rule
Author:ditekSHen
Description:Detects NetWire RAT
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/162832/

Comments