MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ca9c663d1eeb5ce88a6d9a811cab9d3dfd94bde72af9e29f5a5e5d5875902c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ca9c663d1eeb5ce88a6d9a811cab9d3dfd94bde72af9e29f5a5e5d5875902c0
SHA3-384 hash: 081b91859b52734b35ef8040a06a9ba31e992eb885b050cfb9025076272d293407f52c4e5085163c34ac37e64c3c4181
SHA1 hash: 86b9d57a6fca406a01bb7cfdb61d9d0996167637
MD5 hash: 612501eebc731337f3d8565d02f86bad
humanhash: ceiling-video-wolfram-london
File name:SecuriteInfo.com.Gen.Variant.Razy.667199.11038.32706
Download: download sample
File size:200'704 bytes
First seen:2020-05-06 22:39:36 UTC
Last seen:2020-05-07 04:30:10 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 3072:TEgOhX097+C1I5GWp1icKAArDZz4N9GhbkrNEkYPq1jDpmr/J/k+k:TElhE97+7p0yN90QErQDp+5k
TLSH F914AE12BBD88433D8B51B705CF603C30A367CA29E74832B2795B95E1DB3694A53277B
Reporter SecuriteInfoCom

Intelligence

File Origin
# of uploads :
2
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.667199.25280.18198.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 23:35:25 UTC
File Type:
Binary (Archive)
Extracted files:
60
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
persistence family:netwire botnet rat stealer
Link:
https://tria.ge/reports/201109-5rgxlb22ee/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Suspicious behavior: MapViewOfSection
Drops file in Windows directory
Modifies service
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Enumerates connected drives
Loads dropped DLL
Checks QEMU agent state file
Executes dropped EXE
Modifies Installed Components in the registry
NetWire RAT payload
Netwire
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Microsoft Software Installer (MSI) msi 6ca9c663d1eeb5ce88a6d9a811cab9d3dfd94bde72af9e29f5a5e5d5875902c0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/359043/
  
Delivery method
Distributed via web download

Comments