MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73cc33d200ce22012733ea7c3fa8d03ef3ea65164497314d7d05b2992892d4e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73cc33d200ce22012733ea7c3fa8d03ef3ea65164497314d7d05b2992892d4e0
SHA3-384 hash: 3bec9e9540063b1d23e335057223ff240d346bfc56dc35d9f583f1832f7c4ae2b4e346e87fe942668e35b5eb7719c13e
SHA1 hash: a935dc52dc47627adc02347e25eec542ce780421
MD5 hash: 66e7a0d9013714d0c88255d71e3d9b14
humanhash: princess-xray-sierra-texas
File name:73cc33d200ce22012733ea7c3fa8d03ef3ea65164497314d7d05b2992892d4e0
Download: download sample
Signature NanoCore
Create hunting rule
File size:754'176 bytes
First seen:2020-06-10 12:27:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:YMX7G/rTs4oecD4nJIGENw7iGigKV/eB8oWGQH8hu5BcyE2:ypoJ8hEw
Threatray 301 similar samples on MalwareBazaar
TLSH 0BF49FB7DD8C4E1CCE925FFC622999C16156BAB2CDF0A28E674021764C2B7748871DCB
Reporter JAMESWT_WT
Tags:NanoCore

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-26 21:11:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=opgdhuqazyracjzt5j6d7kgqh3z6uziwisltctl5awzjskes2tqa._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
0c34d4763fc968ccbe9f33dec2ae9e3e132a61b40ffc93cc22f337a0758c0279
NanoCore
573f11821c72786131d82bcdb3744b83d01615c25489f4cf2c46181ae6143226
NanoCore
af3c8597b7f874293c5b1fe53c4d1c476c7fdf06df678ba31d75c8f126ae90a0
NanoCore
b0a98ae8b1dadc3b181f6252abef59940ceeb5019cd4ae2f0feadb0a520063cd
NanoCore
b6f5a289ab47b790c1bc57a5a3b35871fc968da66ebb3fdd7669de18c2ba3dd5
NanoCore
c1ffaaa3fad1741534ca46e6eb19dbafebc46932eecccef600f69a615d8e57ea
NanoCore
d3793a581da66ef5840648574ce364846e7c68a559c0f5e49faf9e4892ecdc72
NanoCore
f09dc0b3275b4c1e3a616911805011c2871af1407599493dc980b6987cb313eb
NanoCore
f0caa55fec8b5afbb9799bc2bcd8d965ef420e1138e38ef94c65a6a2037042a3
NanoCore
f2535caecce2737920213eb3f84ad8f9cb783d4562303bfad9bcdbb7749d1c01
NanoCore
+ 291 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet rat stealer
Link:
https://tria.ge/reports/201109-1f6m3cv47x/
Behaviour
NTFS ADS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
NetWire RAT payload
Netwire
Suspicious use of NtCreateProcessExOtherParentProcess
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Malicious_BAT_Strings
Create hunting rule
Author:Florian Roth
Description:Detects a string also used in Netwire RAT auxilliary
Reference:https://pastebin.com/8qaiyPxs
Rule name:MAL_unspecified_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects unspecified malware sample
Reference:Internal Research
Rule name:netwire
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect netwire in memory
Reference:internal research
Rule name:Suspicious_BAT_Strings
Create hunting rule
Author:Florian Roth
Description:Detects a string also used in Netwire RAT auxilliary
Reference:https://pastebin.com/8qaiyPxs
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments