MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c0d31bca17487efc3f743bb9cb5cf56b5f2fae638cf3681fdc692a5809c94be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c0d31bca17487efc3f743bb9cb5cf56b5f2fae638cf3681fdc692a5809c94be
SHA3-384 hash: a15e7b6e25fed4b16aa83d897bf8498e8c85b3edd2f7446a4b7de2882ea990f10b94dba905b9137045869660830b89b7
SHA1 hash: 604c0b8f966c106334744778b3c6f33d2a58c6a9
MD5 hash: d49b27675f5d9c73d6145b3c64cd5ce3
humanhash: failed-london-bulldog-edward
File name:d49b27675f5d9c73d6145b3c64cd5ce3.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:310'440 bytes
First seen:2021-04-07 06:10:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7e13866414f4ebd95471c7c78ee916de (3 x Amadey, 2 x NetWire)
ssdeep 3072:1in5uw68ArDryinkLel3EpvAtzVt3SYoSmDWVimB1bFeZvYeLzvhLS5W6V3eOPw:1UAw6vTkIiAft3S1SmDwpjehJ
Threatray 1'130 similar samples on MalwareBazaar
TLSH C1648C1E62D474A3D0322F709471B7E04339B8645E8765CE9F852A3D2DB1BC5E8F2AC6
Reporter abuse_ch
Tags:exe NetWire RAT


Avatar
abuse_ch
NetWire RAT C2:
winmonitor97435hr.hopto.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
426
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
d49b27675f5d9c73d6145b3c64cd5ce3.exe
Verdict:
No threats detected
Analysis date:
2021-04-07 06:17:06 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fe903b6b-4776-44db-952c-4afe2656040e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/132789/
Detection(s):
SecuriteInfo.com.__vbaHresultCheckObj.7224.24758.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
rans.troj.spyw.evad
Score:
90 / 100
Link:
https://www.joesandbox.com/analysis/668281
Signature
Contains functionality to log keystrokes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Hides threads from debuggers
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential malicious icon found
Sample uses process hollowing technique
Sigma detected: NetWire
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7c0d31bca17487efc3f743bb9cb5cf56b5f2fae638cf3681fdc692a5809c94be/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-04-07 06:11:15 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pqgtdpfbosd67q7xio5zznopk227f6xghdhtnap5y2jklae4ss7a._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
173240b443fdb5cc7ed97cf6eedeb0d823924df3dab6d468c9da2898443f3ac6
NetWire
1a859f18a203b53f7c893f9e3d3cbfeb6bd9c0d479f1ddd5626ba4c9eb34e670
NetWire
3b8dd3bc950e31064f5fe058ed3e8c25f082bef1f42e1426760cc6f8fef14821
NetWire
3cbf0aeafec688023948cad7bf7475270ba9cb1acb0078cf1a9d6288f2751a20
NetWire
8f71fca5621ccb7ba3558cfebc17014d27923d1c73ad97ececb577fd5b937047
NetWire
8fa3eaa46c7d8d1f44a2eeca895f802f2aa7a2251bab347ccb765c72d63ccb58
NetWire
a24fd3aa6733914ccaab078a37a0cb4cf79c2768660de11411662a656507022b
NetWire
a40c51565228f1fef2028b90fd49051372828871d8eeb5df19e5d8049c977ed2
NetWire
a8fe6d7fa624e8e96f71d3ff6375a012b44b51f06179feb7cef8c33fd6d38570
NetWire
acae6556e350e572b83abe1203a0a5e746fdf13c4082916a87e1c721fa747587
NetWire
+ 1'120 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210407-9bkqpjbmgs/
Behaviour
Suspicious use of SetWindowsHookEx
Unpacked files
SH256 hash:
9b6f228890ad0f7d2bd5178dbd8b5352506c599b24c39d501d20ff1b11e706c5
MD5 hash:
25b6c7123e31c2c058eea8ec561aec47
SHA1 hash:
789335ecbe3ae70e2c567498bda2f10f2fb8d432
Detections:
win_netwire_g1
Create hunting rule
win_netwire_auto
Create hunting rule
Link:
https://www.unpac.me/results/0e056c61-b768-441e-afca-ad0a405c500a/
SH256 hash:
7c0d31bca17487efc3f743bb9cb5cf56b5f2fae638cf3681fdc692a5809c94be
MD5 hash:
d49b27675f5d9c73d6145b3c64cd5ce3
SHA1 hash:
604c0b8f966c106334744778b3c6f33d2a58c6a9
Link:
https://www.unpac.me/results/0e056c61-b768-441e-afca-ad0a405c500a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
netwire
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7c0d31bca17487efc3f743bb9cb5cf56b5f2fae638cf3681fdc692a5809c94be

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:MALWARE_Win_NetWire
Create hunting rule
Author:ditekSHen
Description:Detects NetWire RAT
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NetWire

Executable exe 7c0d31bca17487efc3f743bb9cb5cf56b5f2fae638cf3681fdc692a5809c94be

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1057558/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/132789/

Comments