MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 91f4cceeb3b8d11e2408bd72aead7513f7031226e5ebc969611379b1bd04256a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	91f4cceeb3b8d11e2408bd72aead7513f7031226e5ebc969611379b1bd04256a
SHA3-384 hash:	3aa46c73f291d48f115b889f5897f54702328d7c40255d2510eb039d6ed5c9a0d7ff96578c198f6c5be810fb1fea692f
SHA1 hash:	6a75c9f83affec7a73a4413a779fc48f8da808c6
MD5 hash:	c25d23171d41933e7345dcdfb1788dc4
humanhash:	march-massachusetts-jupiter-four
File name:	Booking Confirmation 02222021951 - copy -PDF.exe
Download:	download sample
Signature	NetWire Create hunting rule
File size:	220'672 bytes
First seen:	2021-02-22 07:51:06 UTC
Last seen:	2021-02-23 15:27:11 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	6144:TJjJ/BxiunX8Gc9/JXAQi6u0zhj3z2zP8FmNIQOdW/p0NY:TN1BcwPcxJw56lE8FmNIQOdW/p0NY
Threatray	357 similar samples on MalwareBazaar
TLSH	3824F89D311039DFC857D476CA981EA6AA513C6B431FC22B9C1B37AD993C887DF940B2
Reporter	abuse_ch
Tags:	exe Maersk NetWire RAT

abuse_ch

Malspam distributing NetWire:

HELO: smtpgw.hepsibulutta.com
Sending IP: 46.4.185.122
From: ''Maersk Booking Service'' <maerskbooking_dept3@protonmail.com>
Reply-To: ''Maersk Booking Service'' <maerskbooking_dept3@protonmail.com>
Subject: Re: Booking Confirmation.
Attachment: Booking Confirmation 02222021951 - copy -PDF.uu (contains "Booking Confirmation 02222021951 - copy -PDF.exe")

NetWire RAT C2:
winwin545456478456.awsmppl.com:1177

Intelligence

File Origin

# of uploads :

# of downloads :

306

Origin country :

n/a

Vendor Threat Intelligence

Detection:

NetWire

Link:

https://www.capesandbox.com/analysis/118279/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Creating a file in the %AppData% directory

Creating a file

DNS request

Sending a UDP request

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Connection attempt to an infection source

Unauthorized injection to a system process

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

NetWire

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/613769

Signature

Allocates memory in foreign processes

Contains functionality to steal Chrome passwords or cookies

Detected unpacking (changes PE section rights)

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Sigma detected: NetWire

Sigma detected: Suspicious Svchost Process

System process connects to network (likely due to code injection or exploit)

Writes to foreign memory regions

Yara detected NetWire RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

netwire

Link:

https://mwdb.cert.pl/sample/91f4cceeb3b8d11e2408bd72aead7513f7031226e5ebc969611379b1bd04256a/

Threat name:

ByteCode-MSIL.Trojan.Generic

Status:

Suspicious

First seen:

2021-02-22 07:02:59 UTC

AV detection:

4 of 47 (8.51%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=sh2mz3vtxdir4jaixvzk5llvcp3qgerg4xv4s2lbcn43dpieevva._file

Verdict:

malicious

Label(s):

netwirerc

Result

Malware family:

netwire

Score:

10/10

Tags:

family:netwire botnet persistence rat stealer

Link:

https://tria.ge/reports/210222-6qt3qvv87j/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Adds Run key to start application

NetWire RAT payload

Netwire

Unpacked files

SH256 hash:

91f4cceeb3b8d11e2408bd72aead7513f7031226e5ebc969611379b1bd04256a

MD5 hash:

c25d23171d41933e7345dcdfb1788dc4

SHA1 hash:

6a75c9f83affec7a73a4413a779fc48f8da808c6

Link:

https://www.unpac.me/results/485bd740-f511-402a-ae5b-b491ccfa7c97/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	win_netwire_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator