MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 964e264ece7fcb86df194ed5773d83e298b513c320857b0106c845d4dca0e29c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 964e264ece7fcb86df194ed5773d83e298b513c320857b0106c845d4dca0e29c
SHA3-384 hash: ab5c7b6d8487f8dc09bda4cb99841e608722ad9b4ee62de6539e8ad0143e68c7c0e10ad02ee9513ab6696152101e2d51
SHA1 hash: 72c90f3299dd84f64a1dd1cd03c68574b7e12c44
MD5 hash: 2a946a7a5eb292e76b9a6172666f31f9
humanhash: four-lamp-carpet-high
File name:SecuriteInfo.com.Gen.Variant.Ursu.860578.3823.30588
Download: download sample
File size:200'704 bytes
First seen:2020-05-06 22:39:34 UTC
Last seen:2020-05-07 04:34:17 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 3072:RE8OhX097+C1z5GWp1icKAArDZz4N9GhbkrNEkYYBuE2N6VCOk+Z:RExhE97+wp0yN90QE8v2N6YkZ
TLSH A414AE02BBE88077D9F51BB058F603930A36BCA18D78836B3785794E0DB3694A57177B
Reporter SecuriteInfoCom

Intelligence

File Origin
# of uploads :
3
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Ursu.860578.29996.8063.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-06 23:35:24 UTC
File Type:
Binary (Archive)
Extracted files:
60
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
persistence family:netwire botnet rat stealer
Link:
https://tria.ge/reports/201109-wtf2qsdva6/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Suspicious behavior: MapViewOfSection
Drops file in Windows directory
Modifies service
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Enumerates connected drives
Loads dropped DLL
Checks QEMU agent state file
Executes dropped EXE
Modifies Installed Components in the registry
NetWire RAT payload
Netwire
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Microsoft Software Installer (MSI) msi 964e264ece7fcb86df194ed5773d83e298b513c320857b0106c845d4dca0e29c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/359044/
  
Delivery method
Distributed via web download

Comments