MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73b0fb36b1b8763ebb06328273016c4c4c65b20d2abc3b5bb0566a6f13aa086d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73b0fb36b1b8763ebb06328273016c4c4c65b20d2abc3b5bb0566a6f13aa086d
SHA3-384 hash: f694f00f435faa9460b0a22bc866596bee0665b5df50ae05d428051e3233a5fa27da2ea4c5d6ea2ae9e351e8eeb33a55
SHA1 hash: 60398520b817355b5644f4b3dfbb147638122dd2
MD5 hash: fd175da54494e88a5777471577927264
humanhash: freddie-hotel-hydrogen-enemy
File name:DHL Receipt_pdf.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:429'056 bytes
First seen:2020-08-31 06:25:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'747 x AgentTesla, 19'638 x Formbook, 12'244 x SnakeKeylogger)
ssdeep 12288:LE8FqAfFdMU9KZdozIEx6Vpju3aVDiDC60hp7o6T+oNZqF4:Y8dfFmNckUipju3a
Threatray 328 similar samples on MalwareBazaar
TLSH 01941225036D8F66C7F90BF1089E7968D3A4645B856DD2DA3DA5B28783F63C48337A03
Reporter abuse_ch
Tags:DHL exe NetWire RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: dhl.com
Sending IP: 193.169.253.132
From: DHL Customer Support <support@dhl.com>
Subject: DHL Shipment Notification : 2766998846
Attachment: DHL Receipt_pdf.gz (contains "DHL Receipt_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
281
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/53285/
Detection(s):
SecuriteInfo.com.W32.Trojan-7.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Using the Windows Management Instrumentation requests
Creating a file
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/454936
Signature
.NET source code contains potential unpacker
Contains functionality to steal Chrome passwords or cookies
Creates an undocumented autostart registry key
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: NetWire
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 279847 Sample: DHL Receipt_pdf.exe Startdate: 31/08/2020 Architecture: WINDOWS Score: 100 43 Malicious sample detected (through community Yara rule) 2->43 45 Multi AV Scanner detection for dropped file 2->45 47 Sigma detected: Scheduled temp file as task from temp location 2->47 49 9 other signatures 2->49 9 DHL Receipt_pdf.exe 4 2->9         started        process3 file4 33 C:\Users\user\AppData\Roaming\fukEDc.exe, PE32 9->33 dropped 35 C:\Users\user\AppData\Local\...\tmpB84B.tmp, XML 9->35 dropped 37 C:\Users\user\...\DHL Receipt_pdf.exe.log, ASCII 9->37 dropped 61 Injects a PE file into a foreign processes 9->61 13 DHL Receipt_pdf.exe 3 9->13         started        16 schtasks.exe 1 9->16         started        signatures5 process6 file7 39 C:\Users\user\AppData\Roaming\...\Host.exe, PE32 13->39 dropped 18 Host.exe 3 13->18         started        21 conhost.exe 16->21         started        process8 signatures9 51 Multi AV Scanner detection for dropped file 18->51 53 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 18->53 55 Contains functionality to steal Chrome passwords or cookies 18->55 57 Injects a PE file into a foreign processes 18->57 23 Host.exe 3 18->23         started        27 schtasks.exe 1 18->27         started        29 Host.exe 18->29         started        process10 dnsIp11 41 sepp.myq-see.com 91.193.75.57, 2001, 49716, 49719 DAVID_CRAIGGG Serbia 23->41 59 Creates an undocumented autostart registry key 23->59 31 conhost.exe 27->31         started        signatures12 process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/73b0fb36b1b8763ebb06328273016c4c4c65b20d2abc3b5bb0566a6f13aa086d/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-31 02:14:58 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ooypwnvrxb3d5oyggkbhgalmjrgglmqnfk6dww5qkzvg6e5kbbwq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
1df5bb7918711c70e911c5231544710581b3b6a440d1da6e09bd8160cca5e4b2
NetWire
1ff26ffe5d8d0a87d1a8bd33bf4a8deb427e6c83af241fcf8a798bd489f99254
NetWire
481042b6d1f2b599b5ab6ba70a592ca48ade285d6fcd9f2e28b5896dea5eff71
NetWire
55114bd780868f8b5c0ac827ed3ffa156e09b1949f1d486ffbfd79318ccf1ef4
NetWire
7ca8232e7c1412239e7ae183a33a8546097b37a1ca2fd03d068472f6ad7021c6
NetWire
a4a7810facb6a01422c96f844bf7a537f4b6968190bc1c1de57810e73caa58ff
NetWire
abce854dbb1be834088423c8a911d7111cd6d205b9f6b44be000652860fa03c6
NetWire
b642527e686b781a602fb322e7d34d0f18748778de42a0e3774d9990a71e2c92
NetWire
c4d5fab1e5e40cf0377d5eaca0e427d01fcd61495743ea4290d8745163e84e56
NetWire
d4eec3387fde66fc5b45135db86b9fcdebcb75e199fe9be1a834d89cac6b9d13
NetWire
+ 318 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
rat evasion persistence botnet stealer family:netwire
Link:
https://tria.ge/reports/200831-3rb3qzxt6e/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Maps connected drives based on registry
Checks BIOS information in registry
Loads dropped DLL
Executes dropped EXE
Looks for VMWare Tools registry key
Modifies Installed Components in the registry
Looks for VirtualBox Guest Additions in registry
NetWire RAT payload
Netwire
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/73b0fb36b1b8763ebb06328273016c4c4c65b20d2abc3b5bb0566a6f13aa086d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

gz 13afc1f9891355d495a626a2a7cb4e21d7dc3c29339d9ca162730ae7f097781d

NetWire

Executable exe 73b0fb36b1b8763ebb06328273016c4c4c65b20d2abc3b5bb0566a6f13aa086d

(this sample)

  
Dropped by
MD5 b97a86a838310932be2be42f92aa8474
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 13afc1f9891355d495a626a2a7cb4e21d7dc3c29339d9ca162730ae7f097781d
Cape
Cape
https://www.capesandbox.com/analysis/53285/

Comments