MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62b21f15caf460ffc5fd34e06228587c3b244902d922bade48a1a8b6a6879243. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 62b21f15caf460ffc5fd34e06228587c3b244902d922bade48a1a8b6a6879243
SHA3-384 hash: b3c0f16b1cf767ac851456f91c3c117108277858ef0b36a0b20a3f38cea019f1dceb1f11112f2dea8fc2633b7b19667c
SHA1 hash: c0ceda90527c462802e49b5b60e9ab551995dde3
MD5 hash: ff595877e68673a6a8de043d67b9cff6
humanhash: lithium-mango-snake-april
File name:Ref. # IRQ-21-07778.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:478'646 bytes
First seen:2021-12-21 05:41:58 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 6144:rGiv4W2l3FdF5TNA0QWxOem0Xe4wY7WAM+GLXvaPe7ILNUjzXTyUNU2KdC7IN5R/:ybF40XxOem4r7Wf+SgLN32KEZ0Ncu
Threatray 622 similar samples on MalwareBazaar
TLSH T13CA4239784C094F2CBA194321A714A76E3F2C30847654ACB4F11AFBA7AA74570F7D3B6
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:exe NetWire RAT


Avatar
abuse_ch
NetWire C2:
89.238.150.43:5512

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
89.238.150.43:5512 https://threatfox.abuse.ch/ioc/279263/

Intelligence

File Origin
# of uploads :
1
# of downloads :
385
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Ref. # IRQ-21-07778.exe
Verdict:
Malicious activity
Analysis date:
2021-12-21 06:17:55 UTC
Tags:
installer
Link:
https://app.any.run/tasks/3ceaa1bc-2165-4183-a323-325959e915b3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
NetWire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/215565/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a file
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Creating a process from a recently created file
Sending a custom TCP request
DNS request
Unauthorized injection to a recently created process
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/2811/overview
Behaviour
MalwareBazaar
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
60%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/61c1692d4ab5c44cbf4b1a8d/reports/0f0e0299-09bd-4185-b63b-e1adc40ab87b/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/cf7dad03-875b-4453-b075-5019f0edbc27
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/910755
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes
Found malware configuration
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/62b21f15caf460ffc5fd34e06228587c3b244902d922bade48a1a8b6a6879243/
Threat name:
Win32.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2021-12-21 01:39:32 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
19 of 43 (44.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mkzb6fok6rqp7rp5gtqgekcypq5sisic3erlvxsiugulnjuhsjbq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
0538554b73f98f395950af81f30e4fc99407e991babdce510bb61f9f9b56f23e
NetWire
23fd501c884e2f46d38af81b0d6e423ea0bff8c5eee615227806faf7b2833827
NetWire
3cbf0aeafec688023948cad7bf7475270ba9cb1acb0078cf1a9d6288f2751a20
NetWire
482a6a0bf95d313de664dec7523d7487995d5f26e1a30b8bc62c0a5e1431fbd7
NetWire
4d88027eea794c98e219904f2815eedca85a415a81bc1fb87268cabd5a098c51
NetWire
9a6951c6f3c33c217edd9a4e32f5422c4e125b909d0c88e190b76eb695f05b72
NetWire
b4ac3be33fd7d731376ea3b504995b465122d8ef268e59e7ded5d433762cc932
NetWire
ba468ce1204233cbcb5d473ac13cd5554588480c0186f52e0bd7f091eb3f081c
NetWire
cb54cd1dc1efb943d5308d6681f36ecaec957f0a70f9683f1da3e7e1188b9748
NetWire
ccd667e3a1a0577ed841968990cb37790e1e6f0fb4ceb1a2f947ef391d68dd4d
NetWire
+ 612 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet rat stealer
Link:
https://tria.ge/reports/211221-gd1pzaccg8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
NSIS installer
Enumerates physical storage devices
Program crash
Loads dropped DLL
Executes dropped EXE
NetWire RAT payload
Netwire
Malware Config
C2 Extraction:
89.238.150.43:5512
Unpacked files
SH256 hash:
62b21f15caf460ffc5fd34e06228587c3b244902d922bade48a1a8b6a6879243
MD5 hash:
ff595877e68673a6a8de043d67b9cff6
SHA1 hash:
c0ceda90527c462802e49b5b60e9ab551995dde3
Link:
https://www.unpac.me/results/71c34433-171c-4c09-b3f6-abde54a4f565/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.23
Link:
https://yomi.yoroi.company/submissions/62b21f15caf460ffc5fd34e06228587c3b244902d922bade48a1a8b6a6879243

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:MALWARE_Win_NetWire
Create hunting rule
Author:ditekSHen
Description:Detects NetWire RAT
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.netwire.
Rule name:win_netwire_w0
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:NetWiredRC

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/215565/

Comments