MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c0201a24bb5ce9ed7b2a24dc35cbfe03ecb8546a14f549811e7d4a1b314f32f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 4

Intelligence 4 IOCs YARA 2 File information Comments

SHA256 hash:	4c0201a24bb5ce9ed7b2a24dc35cbfe03ecb8546a14f549811e7d4a1b314f32f
SHA3-384 hash:	8ff229f2d06c1af740fcd4b9ba06279882d4338535f0c8daceca25216e7ed9d0c5aa92a5e514f1b39c998d28e80489f3
SHA1 hash:	c3b9c76f6e040a6b1b3c74f673df1abfc7e489c5
MD5 hash:	3a2b0fcc00b452a592bd3be694fb803f
humanhash:	fifteen-florida-berlin-wisconsin
File name:	3a2b0fcc00b452a592bd3be694fb803f.exe
Download:	download sample
Signature	NetWire Create hunting rule
File size:	338'432 bytes
First seen:	2020-06-12 06:58:34 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'473 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	6144:x/XOcVnLLD1/RgRij3AJe+nHvPYYclasNOGzAg79lyCFZcc2EBM6CW/y9930no9F:hOcVnLd+RijCHvPdG9NOGUgBwNEBnCWE
Threatray	268 similar samples on MalwareBazaar
TLSH	5A748C9D325072EFC417DC739AA82C64AA2078BB870BD643A067159D9A0EBD7CF145F3
Reporter	abuse_ch
Tags:	AveMariaRAT exe NetWire nVpn RAT

abuse_ch

AveMariaRAT payload URL:
http://troygilletc.ug/ac.exe

AveMariaRat C2:
tamera.ug:6970 (79.134.225.49)

Pointing to nVpn:

% Information related to '79.134.225.0 - 79.134.225.63'

% Abuse contact for '79.134.225.0 - 79.134.225.63' is 'abuse@anmaxx.net'

inetnum: 79.134.225.0 - 79.134.225.63
netname: BASEL-HOSTING-225-0
country: CH
admin-c: AM38880-RIPE
tech-c: AM38880-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
created: 2016-04-17T00:42:52Z
last-modified: 2016-04-18T06:23:19Z
source: RIPE
remarks: abuse-c AIS166-RIPE
org: ORG-AGIS12-RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/9139/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.34008023.26277.23721.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-06-11 23:58:56 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jqbadislwxhj5v5sujg4gxf74a7mxbkgufhvjgar47kkdmyu6mxq._file

Verdict:

malicious

Label(s):

netwirerc

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/201109-9t2mdrbdax/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_asyncrat_j1 Create hunting rule
Author:	Johannes Bader @viql
Description:	detects AsyncRAT

Rule name:	win_netwire_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator