MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e52cdd00c05814d563b70e3271df67fb530ec90dca084a4f1b4d3f539e58061. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e52cdd00c05814d563b70e3271df67fb530ec90dca084a4f1b4d3f539e58061
SHA3-384 hash: 7842887242434a1306698c93d4923303d5fc30cdcb3577e85a5e49dbcb1f2631dd6fd8463456997fa05f7cccb54e08eb
SHA1 hash: 60818a679e067a37711e77173355401f4fa8d872
MD5 hash: abf4dcf13ed47c972539ba25f323c3e3
humanhash: shade-fourteen-orange-hot
File name:4e52cdd00c05814d563b70e3271df67fb530ec90dca084a4f1b4d3f539e58061
Download: download sample
Signature NetWire
Create hunting rule
File size:3'405'312 bytes
First seen:2020-06-10 11:42:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c4ab8763277fe07e8a7a1f5ab6c99a11 (2 x NetWire)
ssdeep 49152:Hl5HQiwBGfHAFjoFlL+v+9mb2JusMXIrvJKtORizuQJE5QuNecFE9z9IG:oteN+J2JuatKtaQGzgcFE9
Threatray 258 similar samples on MalwareBazaar
TLSH 3CF54D213580C535CAD222F4895D727053ACECA08B2143DB75987BEEBEB57C25E35ACB
Reporter JAMESWT_WT
Tags:NetWire

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 01:58:13 UTC
File Type:
PE (Exe)
Extracted files:
464
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jzjm3uamawau2vr3odrsohpwp62tb3eq3sqijjhrwtj7kopfqbqq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
151f57078e89aa2f81fcb307bf88fe23e9f2437a4df1e37def5d0b78797e12f8
NetWire
8f9f4cc3a0403e5c2522726849e8a2033d72fc7f36b2317bc9fb86808c1693ec
NetWire
b0a98ae8b1dadc3b181f6252abef59940ceeb5019cd4ae2f0feadb0a520063cd
NetWire
b16b3d99441f078e081e2ac0a8f0121ce4dab264bf434e353d1e00a57e54d3aa
NetWire
b6f5a289ab47b790c1bc57a5a3b35871fc968da66ebb3fdd7669de18c2ba3dd5
NetWire
c1ffaaa3fad1741534ca46e6eb19dbafebc46932eecccef600f69a615d8e57ea
NetWire
c952644e56294c56309d52fffcacdc6d1d054625a3e438727c0a7c3d944eb3e8
NetWire
e04977f7d1fbf8b3a69237bbd2170af6c3046a8ce29e2732cd7c72f079f0e0f8
NetWire
ece26faace5bcf7afeba359279d17aeb7f99f739fce454e964c88ebad9745bdb
NetWire
f53faac8d340d58a2e4916652372ccc1ec9be6a34da5332ee31072ed9c75c37a
NetWire
+ 248 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet persistence stealer
Link:
https://tria.ge/reports/201109-g9p6f6ye5n/
Behaviour
Suspicious use of WriteProcessMemory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Netwire
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments