MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 97c7b0acbb0d187d280e20cd3ac147295ea599462d57f0d56488cda19fcaf3ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 97c7b0acbb0d187d280e20cd3ac147295ea599462d57f0d56488cda19fcaf3ed
SHA3-384 hash: 1e969e728f3d497ae22fb2c01bb5d795e22583b32af028c9eb45f57c817b4f317ec7d9a7f5f44532019dcac98f0e8420
SHA1 hash: 062f06a29a8215409ff26e9678e6c2b43cee6204
MD5 hash: e296446578790b7f09977f2654cdcd92
humanhash: november-hot-lithium-snake
File name:PO Doc 209173.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:626'688 bytes
First seen:2021-11-03 02:15:43 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'013 x AgentTesla, 19'917 x Formbook, 12'332 x SnakeKeylogger)
ssdeep 12288:quTla5JgRDtdRtJX15+oLaA8wSK8gzizdF:3TUL+Zn15V83gzu
Threatray 613 similar samples on MalwareBazaar
TLSH T1D7D48D83EAC16116D9358EBC91644E307256EC3B7DE0F316ADE4F05E2A3BB818C52797
File icon (PE):PE icon
dhash icon f0cceaa4b092ec70 (2 x NetWire)
Reporter abuse_ch
Tags:exe NetWire RAT


Avatar
abuse_ch
NetWire C2:
23.105.131.227:3360

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
23.105.131.227:3360 https://threatfox.abuse.ch/ioc/241701/

Intelligence

File Origin
# of uploads :
1
# of downloads :
413
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO Doc 209173.exe
Verdict:
Malicious activity
Analysis date:
2021-11-03 02:16:38 UTC
Tags:
trojan netwire
Link:
https://app.any.run/tasks/56e6de64-e8c3-4cf5-b7e1-e177d0b666f0

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
NetWire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/201607/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.47300229.15364.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a file in the %temp% directory
Delayed writing of the file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6181f0eebf51178dbe4ad134/reports/10850034-d5c9-4c73-b4e8-ed7867c91a86/overview
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0efb41e6-c5f2-420c-85a4-778c58cb4c7b
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/881858
Signature
.NET source code contains potential unpacker
Contains functionality to steal Chrome passwords or cookies
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 514289 Sample: PO Doc 209173.exe Startdate: 03/11/2021 Architecture: WINDOWS Score: 100 55 Malicious sample detected (through community Yara rule) 2->55 57 Multi AV Scanner detection for dropped file 2->57 59 Multi AV Scanner detection for submitted file 2->59 61 6 other signatures 2->61 8 PO Doc 209173.exe 7 2->8         started        12 Host.exe 4 2->12         started        14 Host.exe 2->14         started        process3 file4 47 C:\Users\user\AppData\Roaming\bakYFB.exe, PE32 8->47 dropped 49 C:\Users\user\AppData\Local\Temp\tmpBB1.tmp, XML 8->49 dropped 51 C:\Users\user\...\PO Doc 209173.exe.log, ASCII 8->51 dropped 63 Injects a PE file into a foreign processes 8->63 16 PO Doc 209173.exe 3 8->16         started        19 schtasks.exe 1 8->19         started        21 schtasks.exe 1 12->21         started        23 Host.exe 12->23         started        25 schtasks.exe 14->25         started        27 Host.exe 14->27         started        signatures5 process6 file7 45 C:\Users\user\AppData\Roaming\...\Host.exe, PE32 16->45 dropped 29 Host.exe 5 16->29         started        32 conhost.exe 19->32         started        34 conhost.exe 19->34         started        36 conhost.exe 21->36         started        38 conhost.exe 25->38         started        process8 signatures9 65 Multi AV Scanner detection for dropped file 29->65 67 Contains functionality to steal Chrome passwords or cookies 29->67 69 Injects a PE file into a foreign processes 29->69 40 Host.exe 3 29->40         started        43 schtasks.exe 1 29->43         started        process10 dnsIp11 53 23.105.131.227, 3360, 49758, 49759 LEASEWEB-USA-NYC-11US United States 40->53
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/97c7b0acbb0d187d280e20cd3ac147295ea599462d57f0d56488cda19fcaf3ed/
Threat name:
ByteCode-MSIL.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2021-11-02 17:21:30 UTC
AV detection:
9 of 44 (20.45%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s7d3blf3bumh2kaoedgtvqkhffpklgkgfvl7bvlerdg2dh6k6pwq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
0f67fd50b46ca7283dc172211a42e3ffab7b524a1e2e23433c34c88e657cd364
NetWire
27fc1cbcf702e483b8eec78bc2605e0d45dda7f0dae2c0adcd6f90b396a1151e
NetWire
2e5d08e10497cdd14499b4ae823f7d639a738d37784882db758e70fa3804e4e9
NetWire
5226a12dc7f7b5e28732ad8b5ad6fa9a35eadfbeec122d798cd53c5ef73fe86a
NetWire
abd18b2d7cfc702e56442f2549808b301f2e0fc214cdf2230d5fbefc9620fd42
NetWire
bd62e723aff056a5f6dd9b9ece4f5ea4bae0a50cc3bdd5f4228fb265c2a96170
NetWire
ce0791b1ccec1c7907e99e48f2207cafa0cd2c8528a5e0f6625187b51a14f284
NetWire
cf2aec2969353dc99a7f715ac818212b42b8cff7a58c9109442f2c65ff62de42
NetWire
+ 603 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet persistence rat stealer
Link:
https://tria.ge/reports/211103-cp6cdaaabn/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
NetWire RAT payload
Netwire
Malware Config
C2 Extraction:
23.105.131.227:3360
Unpacked files
SH256 hash:
7ec7c47de5927351c7035f8657a2dd91c42fd6ed6e4da309e34b87ef0b0ba785
MD5 hash:
171a2669225911b41301096cd9dcf19f
SHA1 hash:
dc25f1f69faec5174e489a0d1a18cf14cf7fd1b5
Link:
https://www.unpac.me/results/934de79c-93f0-4b5e-9114-c8a851119f05/
SH256 hash:
18bb0c30a113d0a3139da246c6ea34822f19cffdd84e5620a7b86d721ba28cca
MD5 hash:
2326e0811cdb2957f801e0cd6a8aa8bd
SHA1 hash:
91f05878ec0b3f107fc9d746c1044b311c7beb22
Link:
https://www.unpac.me/results/934de79c-93f0-4b5e-9114-c8a851119f05/
SH256 hash:
41fcbe21483232458b28f522a9bd4dc6facb6193c3a0ac12730f831183f4788a
MD5 hash:
74d68fb9afba0baf5745b28998536ca2
SHA1 hash:
264256b89ee37eac1096b1fc177b3f8e2bc94e22
Detections:
win_netwire_g1
Create hunting rule
win_netwire_auto
Create hunting rule
Link:
https://www.unpac.me/results/934de79c-93f0-4b5e-9114-c8a851119f05/
Parent samples :
97c7b0acbb0d187d280e20cd3ac147295ea599462d57f0d56488cda19fcaf3ed
77256dbd8c0a417df262ad441056cc29c4ee5a70a9005b2fa4f32efbec768083
SH256 hash:
97c7b0acbb0d187d280e20cd3ac147295ea599462d57f0d56488cda19fcaf3ed
MD5 hash:
e296446578790b7f09977f2654cdcd92
SHA1 hash:
062f06a29a8215409ff26e9678e6c2b43cee6204
Link:
https://www.unpac.me/results/934de79c-93f0-4b5e-9114-c8a851119f05/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/97c7b0acbb0d187d280e20cd3ac147295ea599462d57f0d56488cda19fcaf3ed

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:MALWARE_Win_NetWire
Create hunting rule
Author:ditekSHen
Description:Detects NetWire RAT
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.netwire.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/201607/

Comments