MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 818bed3da07ea9e48989e4d61e6190df849ada635bfdc53ce86544a2deaa8ef0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 818bed3da07ea9e48989e4d61e6190df849ada635bfdc53ce86544a2deaa8ef0
SHA3-384 hash: 0999894e828e16390f38c1e75232f81429370d514600ef4c66cfccef7a2f35922d76081fa9c45a7c19751295ef866a59
SHA1 hash: be6cbbb50d8e62a7b3ce12ce48da62956cf5d19d
MD5 hash: 0aead88fe558b184c86355a085764067
humanhash: floor-alanine-wisconsin-idaho
File name:ACCONUXXX78.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:486'255 bytes
First seen:2022-03-01 06:20:15 UTC
Last seen:2022-03-01 07:48:40 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 6144:IGiZdPcmSAjS7fEie3lfyGR/n2xTJiX6+Ke2py9uPFOnPjWeSKYrWp2+eaHf3kN4:gdPcmSAjkfEbfmx87Ke2pw0QWz+2tXe
Threatray 44 similar samples on MalwareBazaar
TLSH T1D7A47AC5E9819676D54B9630267CBE2A8A19AFF5306CCB1448EC3D0B3D31B1D3693DA3
File icon (PE):PE icon
dhash icon 6ce0d2d6d2d2c4dc (3 x NetWire, 3 x NanoCore, 1 x RedLineStealer)
Reporter abuse_ch
Tags:exe NetWire RAT


Avatar
abuse_ch
NetWire C2:
194.147.140.14:4550

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
194.147.140.14:4550 https://threatfox.abuse.ch/ioc/391224/

Intelligence

File Origin
# of uploads :
2
# of downloads :
382
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NetWire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/245523/
Detection(s):
SecuriteInfo.com.W32.FormBook.H.genEldorado.25697.22297.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/621dbb54b94fb38cb42bbbd7/reports/252c721e-d1b7-457f-8c64-b872bbc89ac6/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
NetWire RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ec84e0c1-78a3-44d6-8a8e-022d0a2e83a0
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/947860
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to steal Chrome passwords or cookies
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NetWire RAT Registry Key
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 580341 Sample: ACCONUXXX78.exe Startdate: 01/03/2022 Architecture: WINDOWS Score: 100 31 store-images.s-microsoft.com 2->31 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus detection for URL or domain 2->43 45 6 other signatures 2->45 8 ACCONUXXX78.exe 18 2->8         started        11 umnsmkexpiut.exe 2->11         started        14 umnsmkexpiut.exe 2->14         started        signatures3 process4 file5 29 C:\Users\user\AppData\Local\Temp\wsogo.exe, PE32 8->29 dropped 16 wsogo.exe 1 2 8->16         started        47 Multi AV Scanner detection for dropped file 11->47 20 WerFault.exe 3 10 11->20         started        22 WerFault.exe 10 14->22         started        signatures6 process7 file8 27 C:\Users\user\AppData\...\umnsmkexpiut.exe, PE32 16->27 dropped 35 Multi AV Scanner detection for dropped file 16->35 37 Contains functionality to steal Chrome passwords or cookies 16->37 24 wsogo.exe 2 16->24         started        signatures9 process10 dnsIp11 33 194.147.140.14, 4550, 49747 PTPEU unknown 24->33
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/818bed3da07ea9e48989e4d61e6190df849ada635bfdc53ce86544a2deaa8ef0/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-03-01 06:21:14 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qgf62pnap2u6jcmj4tlb4ymq36cjvwtdlp64kphimvckfxvkr3ya._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
03dcc84a1b2387ef18e82b9deeaa45da311890d27b3d28d022d43924201b7bcc
NetWire
1d54082d540ab23f276aafeb6bad1b8c7b0c435fc539dcda3be3f6423da0d8f4
NetWire
3cc9ec44e7516c0db0a27794c540fcc5a0c6d322821debaee8bd4d0a1231b4df
NetWire
a5552237bf0ede9675b646aea11141c7763ed882fc8dbfe1b036f6347fe98ad3
NetWire
e4715658b6981b37c06e063e6b59af6d82c8c5edeb93e339e367d497332b7b69
NetWire
e83b81147f0b08a09751772c75cdec2522f2fce19b1f035a2ddc415f633dd2e0
NetWire
ec151e8b6c21fa0d0ed0550629a8421c797635dcdc8662454c37e3f25a41e9f1
NetWire
+ 34 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet persistence rat stealer
Link:
https://tria.ge/reports/220301-g4c2lagee4/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
NetWire RAT payload
Netwire
Malware Config
C2 Extraction:
194.147.140.14:4550
Unpacked files
SH256 hash:
a8dde87c6311e0692b210437c9f76f57dbdc786276d79c3a27d21bd431d2d5fc
MD5 hash:
c4d66baae6a7dd0227cae66fa73ce16c
SHA1 hash:
f3fc5f04a37a4194d74cd86e0b4255d64daa6119
Detections:
win_netwire_g1
Create hunting rule
Link:
https://www.unpac.me/results/93d11b47-95fe-4287-8c0b-7feb61a520b7/
Parent samples :
ec151e8b6c21fa0d0ed0550629a8421c797635dcdc8662454c37e3f25a41e9f1
a5552237bf0ede9675b646aea11141c7763ed882fc8dbfe1b036f6347fe98ad3
818bed3da07ea9e48989e4d61e6190df849ada635bfdc53ce86544a2deaa8ef0
9b697bd07f78c00751511ba619ba1a018d3628378d7e2d6c7ba35ceb9e99cac4
SH256 hash:
093c23199e57643490c1926c4f1585ee324098c23a414e8500a60fd5ebb44d12
MD5 hash:
805d43eb5a5d7610b62334873fb00178
SHA1 hash:
d6c4d42de07cee127d95bf602827776f4586192d
Link:
https://www.unpac.me/results/93d11b47-95fe-4287-8c0b-7feb61a520b7/
SH256 hash:
818bed3da07ea9e48989e4d61e6190df849ada635bfdc53ce86544a2deaa8ef0
MD5 hash:
0aead88fe558b184c86355a085764067
SHA1 hash:
be6cbbb50d8e62a7b3ce12ce48da62956cf5d19d
Link:
https://www.unpac.me/results/93d11b47-95fe-4287-8c0b-7feb61a520b7/
Malware family:
NetWiredRC
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/818bed3da07e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.63
Link:
https://yomi.yoroi.company/submissions/818bed3da07ea9e48989e4d61e6190df849ada635bfdc53ce86544a2deaa8ef0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:MALWARE_Win_NetWire
Create hunting rule
Author:ditekSHen
Description:Detects NetWire RAT
Rule name:MAL_unspecified_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects unspecified malware sample
Reference:Internal Research
Rule name:MAL_unspecified_Jan18_1_RID2F4A
Create hunting rule
Author:Florian Roth
Description:Detects unspecified malware sample
Reference:Internal Research
Rule name:win_netwire_w0
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:NetWiredRC

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/245523/

Comments