MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 760c5c96174d0f5f899970f3b35da290b831f4c85221b1e274a5491fcf08b264. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 760c5c96174d0f5f899970f3b35da290b831f4c85221b1e274a5491fcf08b264
SHA3-384 hash: 20fab74d85d6ac301adffd7f06497ea0ec41fc66de0de2b1ac74ebb1eb3fbb11d45074cf21f9277f6087d6e875daeccd
SHA1 hash: c7f8bfa1d89ed508d4bd94ed27a25249e7cc566a
MD5 hash: 980d697b93ed57b9e37a53f19d202a1e
humanhash: robert-freddie-muppet-music
File name:40% TT Transfer Swift_pdf.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:1'143'808 bytes
First seen:2020-08-05 12:04:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 24576:D6e5AOCWx9BjgBScyp+Lb9RP0rHV71kzgTctpwKpw7rh+y:DfAOCWxjjgobp+LbfPopegTctpRp2rhf
Threatray 263 similar samples on MalwareBazaar
TLSH BC35D0A17984DF5DC82E0F3038136810EBE1EE061E45F78FAC8679FC5AB96464E1A74D
Reporter abuse_ch
Tags:exe NetWire nVpn RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: hinet.net
Sending IP: 176.123.10.138
From: gm@hinet.net
Subject: 40% TT Transfer Copy
Attachment: 40% TT Transfer Swift_pdf.rar (contains "40% TT Transfer Swift_pdf.exe")

NetWire RAT C2:
harromex.com:4020 (194.5.97.93)

Pointing to nVpn:

% Information related to '194.5.97.0 - 194.5.97.255'

% Abuse contact for '194.5.97.0 - 194.5.97.255' is 'abuse@kgb-vpn.org'

inetnum: 194.5.97.0 - 194.5.97.255
netname: NET-NINAZU
remarks: ------------------------------------------
remarks: * This network is used for a VPN service.
remarks: * No logs are stored in any shape or form.
remarks: ------------------------------------------
country: EU
admin-c: NVS100-RIPE
tech-c: NVS100-RIPE
org: ORG-NVS2-RIPE
mnt-by: NINAZU-MNT
status: SUB-ALLOCATED PA
created: 2018-07-23T09:31:45Z
last-modified: 2020-08-02T13:13:48Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
321
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/39531/
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.23743.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% subdirectories
Creating a file
Creating a process from a recently created file
Unauthorized injection to a recently created process
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/411132
Signature
Contains functionality to steal Chrome passwords or cookies
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Sigma detected: NetWire
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AntiVM_3
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 257906 Sample: 40% TT Transfer Swift_pdf.exe Startdate: 05/08/2020 Architecture: WINDOWS Score: 88 36 harromex.com 2->36 42 Yara detected NetWire RAT 2->42 44 Yara detected AntiVM_3 2->44 46 Sigma detected: NetWire 2->46 48 4 other signatures 2->48 9 40% TT Transfer Swift_pdf.exe 3 2->9         started        13 Host.exe 2 2->13         started        15 Host.exe 2 2->15         started        signatures3 process4 file5 34 C:\...\40% TT Transfer Swift_pdf.exe.log, ASCII 9->34 dropped 56 Injects a PE file into a foreign processes 9->56 17 40% TT Transfer Swift_pdf.exe 3 9->17         started        20 Host.exe 13->20         started        22 Host.exe 15->22         started        signatures6 process7 file8 32 C:\Users\user\AppData\Roaming\...\Host.exe, PE32 17->32 dropped 24 Host.exe 3 17->24         started        process9 signatures10 50 Machine Learning detection for dropped file 24->50 52 Contains functionality to steal Chrome passwords or cookies 24->52 54 Injects a PE file into a foreign processes 24->54 27 Host.exe 3 24->27         started        30 Host.exe 24->30         started        process11 dnsIp12 38 harromex.com 194.5.97.93, 4020, 49723, 49726 DANILENKODE Netherlands 27->38 40 192.168.2.1 unknown unknown 27->40
Detection:
netwire
Create hunting rule
Link:
https://mwdb.cert.pl/sample/760c5c96174d0f5f899970f3b35da290b831f4c85221b1e274a5491fcf08b264/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 12:06:08 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oygfzfqxjuhv7cmzodz3gxncsc4dd5gikiq3dytuuver7tyiwjsa._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
06835e2c284ded66ca44497caf918d1ce6f216e68af866e85ac6fb79332b75f7
NetWire
1296e2be1e9e8dc2431cd3c37337af6fe9f2ad6e9b380111507b009642250216
NetWire
2928d0d53b459f6b822fd781360a743b3548f31c31c012ba8a25b42235aff154
NetWire
76f20f51dda2d37c9e1c9ddff49fa03defa148abcfd399dfd2c0633f5609cc7d
NetWire
8c940846bd45f30de0358c90c8caef670b5e15bc9468452418d215c40ed62a20
NetWire
9a6951c6f3c33c217edd9a4e32f5422c4e125b909d0c88e190b76eb695f05b72
NetWire
9de5e8e2d7733dfcf568e5b11a95d2468ef905e90169d7a4c93e1909a0372f04
NetWire
d19e690275e1eec487544552366accd109567893c79b3634cef31515b9a0a19b
NetWire
e6db6d5f9019bdefffc749264a267c1927dcf5eba5a7ea3dfb10db457b6b2a16
NetWire
eaf820c89e009bafc8d9b577392f83a203e37ffc8b0a3e9281e313a705836e28
NetWire
+ 253 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
rat persistence botnet stealer family:netwire
Link:
https://tria.ge/reports/200805-hntzvmpgz2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
NetWire RAT payload
Netwire
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/760c5c96174d0f5f899970f3b35da290b831f4c85221b1e274a5491fcf08b264

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

rar 3daf55f37b276d2fc7e0b9e1a101d9445e3bb59fcd1d19a85c51efd48ecac37f

NetWire

Executable exe 760c5c96174d0f5f899970f3b35da290b831f4c85221b1e274a5491fcf08b264

(this sample)

  
Dropped by
MD5 4cb49a9ce780edbcfcca65c7618d78cd
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/39531/
  
Dropped by
SHA256 3daf55f37b276d2fc7e0b9e1a101d9445e3bb59fcd1d19a85c51efd48ecac37f

Comments