MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 880a3f89941849fc46d6921a4ef7326e4b2b074a505e916cac0eb1cd0f15c45f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 10

Intelligence 10 IOCs YARA 5 File information Comments

SHA256 hash:	880a3f89941849fc46d6921a4ef7326e4b2b074a505e916cac0eb1cd0f15c45f
SHA3-384 hash:	810d6a85c72f46328a2b2365dd0e195791d56e01cc419af0b38444411204e827f480571dcb9d55b5d01934c74ad915b1
SHA1 hash:	40a64033360e7c4470e6df4936face5a57e207dd
MD5 hash:	cd6ed40444fd15e7b769d7f09f52ff33
humanhash:	august-yellow-thirteen-hotel
File name:	PROOF_OF.EXE
Download:	download sample
Signature	NetWire Create hunting rule
File size:	560'128 bytes
First seen:	2020-10-05 07:03:51 UTC
Last seen:	2020-10-05 07:40:37 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	12288:1J2wtEGI4ES/RICG6B+rD4lh5ZT9WDsxNu:1J2hG1ES/RICGTr8zbMYxN
Threatray	37 similar samples on MalwareBazaar
TLSH	98C4E12076A84B19D8FBA7F65938D01447B63E953163E39D8DD271DE2872F004B32A6F
Reporter	cocaman
Tags:	exe NetWire

Intelligence

File Origin

# of uploads :

# of downloads :

224

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/68056/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Unauthorized injection to a recently created process

Creating a file

Connection attempt

Enabling autorun by creating a file

Result

Threat name:

Netwire

Detection:

malicious

Classification:

troj.evad

Score:

88 / 100

Link:

https://www.joesandbox.com/analysis/481042

Signature

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM_3

Yara detected Netwire RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

netwire

Link:

https://mwdb.cert.pl/sample/880a3f89941849fc46d6921a4ef7326e4b2b074a505e916cac0eb1cd0f15c45f/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-10-05 06:21:36 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rafd7cmudbe7yrwwsine55zsnzfswb2kkbpjc3fmb2y42dyvyrpq._file

Verdict:

malicious

Label(s):

netwirerc

Result

Malware family:

netwire

Score:

10/10

Tags:

rat botnet stealer family:netwire

Link:

https://tria.ge/reports/201005-737tyws75j/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

NetWire RAT payload

Netwire

Unpacked files

SH256 hash:

880a3f89941849fc46d6921a4ef7326e4b2b074a505e916cac0eb1cd0f15c45f

MD5 hash:

cd6ed40444fd15e7b769d7f09f52ff33

SHA1 hash:

40a64033360e7c4470e6df4936face5a57e207dd

Link:

https://www.unpac.me/results/57d6edb3-b39d-4322-8542-5a34597f25dc/

SH256 hash:

b4333c8897e21796517c89c1945d75365b05a742ee3f8a8ea7d279dbc37d002e

MD5 hash:

455a33b29de509115059ad38c79280d2

SHA1 hash:

0bf8470ba173c79a0fc7694811340c5e3fa96fb5

Detections:

win_netwire_g1

win_netwire_auto

Link:

https://www.unpac.me/results/57d6edb3-b39d-4322-8542-5a34597f25dc/

Parent samples :

880a3f89941849fc46d6921a4ef7326e4b2b074a505e916cac0eb1cd0f15c45f
98eeb35497473e4739441aabdd0e47d31ad8d3e1f43a121df4b9c72012426e84
10f51498a4583ec4c9c2f3e58f761c01e3a28d674daddd4f38881fc5d3d705c2
b0f6052c071380b0413ba33ab5f888442bba649614a7102ade644d7195487bed

SH256 hash:

607f04646c9f16f7c23fa69d4b8f660fc7c44d40e4f73a0c70a2b315debdaa8b

MD5 hash:

a90baadadf904455325f7bc787185c7b

SHA1 hash:

7d833bb819d638008c98be469b05db2feaf201cd

Link:

https://www.unpac.me/results/57d6edb3-b39d-4322-8542-5a34597f25dc/

SH256 hash:

bfb48e2fc12620b1dcf79b4a33d2c5eead63be15b9391941fdb1271e01e97bef

MD5 hash:

5f5db0175c27340cf21c6f768e77a95b

SHA1 hash:

d913abec53efac6e7ec09cb97c28e15098a07ef8

Link:

https://www.unpac.me/results/57d6edb3-b39d-4322-8542-5a34597f25dc/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

AgentTesla

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/880a3f89941849fc46d6921a4ef7326e4b2b074a505e916cac0eb1cd0f15c45f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Malicious_BAT_Strings Create hunting rule
Author:	Florian Roth
Description:	Detects a string also used in Netwire RAT auxilliary
Reference:	https://pastebin.com/8qaiyPxs

Rule name:	MAL_unspecified_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects unspecified malware sample
Reference:	Internal Research

Rule name:	netwire Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect netwire in memory
Reference:	internal research

Rule name:	Suspicious_BAT_Strings Create hunting rule
Author:	Florian Roth
Description:	Detects a string also used in Netwire RAT auxilliary
Reference:	https://pastebin.com/8qaiyPxs

Rule name:	win_netwire_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator