MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6bd34d33ccb47430751ae964ca56ec206da0fa3bdc5eb670fc54edf4c11629bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWalker


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6bd34d33ccb47430751ae964ca56ec206da0fa3bdc5eb670fc54edf4c11629bc
SHA3-384 hash: 57802f0dc71af553bb0a62512bb941c5e6fc842c4590e3b4311de157c1eec7fc2339eeb2f817f1d780ea9cad505307e8
SHA1 hash: 2861da47ebc33a57aa93e483b1ea946a5b33b345
MD5 hash: 3f3cc36f4298c4db8e77794eb96db81a
humanhash: wyoming-potato-fix-whiskey
File name:6bd34d33ccb47430751ae964ca56ec206da0fa3bdc5eb670fc54edf4c11629bc
Download: download sample
Signature NetWalker
Create hunting rule
File size:70'656 bytes
First seen:2020-06-01 14:30:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e82dd51b077167be63c004bed23d0c1e (40 x NetWalker, 2 x GuLoader, 1 x ShikataGaNai)
ssdeep 1536:juCWRxL7hbUiQfovecnXUU+hhOZuIWiFp+ZfaBZebC33O+J1EvFb:KCWf7VJQfmeMXvkhOZu1iFBBZebC38J
Threatray 72 similar samples on MalwareBazaar
TLSH 77635B83F282C2B0D98646F96BFFF37E08725D14977589C3CB521D01E9398E2593A35A
Reporter Anonymous
Tags:NetWalker


Avatar
Anonymous
Zero2Automated Course

Intelligence

File Origin
# of uploads :
1
# of downloads :
2'035
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Ransomware.Netwalker-7671868-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Netwalker
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 08:32:13 UTC
File Type:
PE (Exe)
AV detection:
29 of 30 (96.67%)
Threat level:
  5/5
Verdict:
unknown
Similar samples:
0d0ed90929351c08c47dbd7541073d037240718c4a2fd63c09d2377090d4cd7a
NetWalker
352cd5d318e4cff15910dc70b609ef9bf1d1ee0b7f01e186bedb5e7d245e3ec6
NetWalker
4abf2d4b604ad5c3dca0006e9762562ea104e76e7c0dcfa8fddafda8b11b2eaf
NetWalker
5d869c0e077596bf0834f08dce062af1477bf09c8f6aa0a45d6a080478e45512
NetWalker
63ad8faf3c2b306ccd8aa7874e24e7d48e0f6bbeeb37adab26c2efa1410022c4
NetWalker
8f06645838d3d75e44d4527e2928c71af0a7214254867379359eb3e46109cbde
NetWalker
a9a147313861a5a4e7abd76b3287ce5f6183966b89c5ca95c0e0cf587f40189d
NetWalker
c21ecd18f0bbb28112240013ad42dad5c01d20927791239ada5b61e1c6f5f010
NetWalker
f298725e197f974b7a8407c5d79114a4ac322c573813d543141ccf1d9119dd8b
NetWalker
fd3489f6067ef7ca3999776205839424cb7349134baaeb693abcecaa2c5bf913
NetWalker
+ 62 additional samples on MalwareBazaar
Result
Malware family:
netwalker
Create hunting rule
Score:
  10/10
Tags:
family:netwalker persistence ransomware spyware
Link:
https://tria.ge/reports/201109-288gtf98en/
Behaviour
Interacts with shadow copies
Kills process with taskkill
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Modifies service
Deletes itself
Reads user/profile data of web browsers
Modifies extensions of user files
Deletes shadow copies
Netwalker Ransomware
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:netwalker_ransomware
Create hunting rule
Author:Marc Rivero | McAfee ATR Team
Description:Rule to detect Netwalker ransomware
Reference:https://www.ccn-cert.cni.es/comunicacion-eventos/comunicados-ccn-cert/9802-publicado-un-informe-de-codigo-danino-sobre-netwalker.html

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments