MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5226a12dc7f7b5e28732ad8b5ad6fa9a35eadfbeec122d798cd53c5ef73fe86a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5226a12dc7f7b5e28732ad8b5ad6fa9a35eadfbeec122d798cd53c5ef73fe86a
SHA3-384 hash: f5575f2041b67275b4facd8197fb4e92c9e50a26f88d79bab463c16f4b12ef14f13260254e71083f2ad740f5ef919fae
SHA1 hash: cc5b97876fe9b09e2e0618a9f1a7c4dc1d78d129
MD5 hash: dbd37b8c044a27ec8008c6489231075f
humanhash: november-magazine-berlin-kilo
File name:DBD37B8C044A27EC8008C6489231075F.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:367'616 bytes
First seen:2021-08-04 17:05:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7987728ab4833eef53b128d3c56918f3 (1 x NetWire)
ssdeep 6144:ZlfjLIs254Cz4FatkOAOqQxM3QLylFzk8x2dQ325Y/XDzQsFv:Z9jLIs25BrxM3+yHY84dQmGzz7F
Threatray 810 similar samples on MalwareBazaar
TLSH T16A74CF5074D1C472D876063508F4DBB84A3EBD250B259AEB77C83B7E0F352D1AA31AB6
dhash icon d4c4c4d8ccd4d0c4 (10 x AveMariaRAT, 6 x AgentTesla, 2 x Formbook)
Reporter abuse_ch
Tags:exe NetWire RAT


Avatar
abuse_ch
NetWire C2:
66.154.103.106:13377

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
66.154.103.106:13377 https://threatfox.abuse.ch/ioc/165701/

Intelligence

File Origin
# of uploads :
1
# of downloads :
592
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
student-termination-and-proof.zip
Verdict:
Malicious activity
Analysis date:
2021-08-03 11:58:16 UTC
Tags:
trojan rat netwire
Link:
https://app.any.run/tasks/497194b3-31e0-4e5f-a902-04811515d041

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
NetWire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/176409/
Detection(s):
SecuriteInfo.com.Variant.Johnnie.372218.28022.6636.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
NetWire RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/06dbdf04-811e-41e8-9a33-f0d98735aa5e
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
75 / 100
Link:
https://www.joesandbox.com/analysis/827065
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to inject code into remote processes
Contains functionality to steal Chrome passwords or cookies
Found malware configuration
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses cmd line tools excessively to alter registry or file data
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 459496 Sample: 1Y15G26Y1F.exe Startdate: 04/08/2021 Architecture: WINDOWS Score: 75 47 Found malware configuration 2->47 49 Multi AV Scanner detection for dropped file 2->49 51 Multi AV Scanner detection for submitted file 2->51 53 5 other signatures 2->53 7 1Y15G26Y1F.exe 1 2->7         started        10 Adobe Acrobat.exe 1 2->10         started        12 Adobe Acrobat.exe 1 2->12         started        process3 signatures4 55 Contains functionality to steal Chrome passwords or cookies 7->55 57 Contains functionality to inject code into remote processes 7->57 59 Injects a PE file into a foreign processes 7->59 14 cmd.exe 3 7->14         started        18 1Y15G26Y1F.exe 2 7->18         started        21 conhost.exe 7->21         started        23 cmd.exe 1 10->23         started        25 Adobe Acrobat.exe 10->25         started        27 conhost.exe 10->27         started        29 cmd.exe 1 12->29         started        31 Adobe Acrobat.exe 12->31         started        33 conhost.exe 12->33         started        process5 dnsIp6 41 C:\Users\user\AppData\...\Adobe Acrobat.exe, PE32 14->41 dropped 43 C:\...\Adobe Acrobat.exe:Zone.Identifier, ASCII 14->43 dropped 61 Uses cmd line tools excessively to alter registry or file data 14->61 35 reg.exe 1 1 14->35         started        45 66.154.103.106, 13377, 49719, 49722 ASN-QUADRANET-GLOBALUS Canada 18->45 37 reg.exe 1 23->37         started        39 reg.exe 1 29->39         started        file7 signatures8 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5226a12dc7f7b5e28732ad8b5ad6fa9a35eadfbeec122d798cd53c5ef73fe86a/
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2021-07-30 22:26:34 UTC
AV detection:
18 of 46 (39.13%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kitkcloh6626fbzsvwfvvvx2ti26vx565qjc26mm2u6f55z75bva._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
0c34d4763fc968ccbe9f33dec2ae9e3e132a61b40ffc93cc22f337a0758c0279
NetWire
2e54ae1fe78471492cc217d238fcd7f0158ae8f22a35e9576a91b3a6614c2d08
NetWire
557b7d3dbc3f34338f5a6c1467f399abc0b3ef004d7378b7ff78f80d96fbc244
NetWire
573f11821c72786131d82bcdb3744b83d01615c25489f4cf2c46181ae6143226
NetWire
6bcd9c589b51cbd1011942b2bdaeaab62748c7380a17336b35bf589c880553b8
NetWire
7b9a1aa88be62eb638af26146fce0a1b71aec646d2495fb350dd6d56997e7582
NetWire
91f4cceeb3b8d11e2408bd72aead7513f7031226e5ebc969611379b1bd04256a
NetWire
c4b73299f51cc04c30ee6080144f960c8d5de3d62c0e0b10c6c497f57b844474
NetWire
cf2aec2969353dc99a7f715ac818212b42b8cff7a58c9109442f2c65ff62de42
NetWire
f09dc0b3275b4c1e3a616911805011c2871af1407599493dc980b6987cb313eb
NetWire
+ 800 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet persistence rat stealer
Link:
https://tria.ge/reports/210804-xrl988c5rx/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
NetWire RAT payload
Netwire
Malware Config
C2 Extraction:
66.154.103.106:13377
Unpacked files
SH256 hash:
081a21befa61d89785dbe6d598720622bea10a5415cb5913ca32d1e67dcc95aa
MD5 hash:
53d609c3d19c2dfbfe787694f3f933a5
SHA1 hash:
95d1eff937e7ce83cf2e21896f60d1c8d6c4fb30
Detections:
win_netwire_g1
Create hunting rule
win_netwire_auto
Create hunting rule
Link:
https://www.unpac.me/results/508009f1-980b-4118-bbb5-468a54a89f4a/
Parent samples :
5226a12dc7f7b5e28732ad8b5ad6fa9a35eadfbeec122d798cd53c5ef73fe86a
7c12a820fd7e576f3a179cdccaefbfcd090e0f890fccfab7615bc294795dc244
SH256 hash:
5226a12dc7f7b5e28732ad8b5ad6fa9a35eadfbeec122d798cd53c5ef73fe86a
MD5 hash:
dbd37b8c044a27ec8008c6489231075f
SHA1 hash:
cc5b97876fe9b09e2e0618a9f1a7c4dc1d78d129
Link:
https://www.unpac.me/results/508009f1-980b-4118-bbb5-468a54a89f4a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5226a12dc7f7b5e28732ad8b5ad6fa9a35eadfbeec122d798cd53c5ef73fe86a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:MALWARE_Win_NetWire
Create hunting rule
Author:ditekSHen
Description:Detects NetWire RAT
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.netwire.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/176409/

Comments