MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98a046d5edb9540592c6b45a2efa070864637109894d8d831e804ba09bbbcbb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98a046d5edb9540592c6b45a2efa070864637109894d8d831e804ba09bbbcbb4
SHA3-384 hash: 78ae8e1b4691a585dc7ae8bc81d26d68ff147f4f949db1a00207711f44617d6f9432787f6850fef0cd3aa134a9cea7f3
SHA1 hash: 357ca18d11d7d61b3826e47d8f69579d8909508a
MD5 hash: 754fd049502c2333dc04447b86a4f4b7
humanhash: pennsylvania-idaho-quebec-colorado
File name:Pago Mar 2021 at 1.15_PP3343_PDF.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:240'697 bytes
First seen:2021-03-03 18:00:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 3072:NJ2S2L6KbqDCwc1PHzJdMivWuNo/4uUPZRQMIBKJoFvPMNUutjyhsJXAgZalGsJZ:N8LxBmieyFPEBKmapC6wUojBs/ckG
Threatray 372 similar samples on MalwareBazaar
TLSH BB34126773E2C5B7D6D657720AE7D7ABB7FFC200026691031B212FBBB71108B4A18256
Reporter abuse_ch
Tags:Caxia DHL ESP exe geo NetWire RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: ns3.evs10.com
Sending IP: 91.142.219.13
From: La Caixa <info@lacaixa.com>
Subject: RV: Confirmacion De Cuenta
Attachment: Pago Mar 2021 at 1.15_PP3343_PDF.img (contains "Pago Mar 2021 at 1.15_PP3343_PDF.exe")

NetWire RAT C2:
mkv45.ddns.net:7210 (103.133.109.176)

Intelligence

File Origin
# of uploads :
1
# of downloads :
325
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Pago Mar 2021 at 1.15_PP3343_PDF.exe
Verdict:
Malicious activity
Analysis date:
2021-03-03 18:15:16 UTC
Tags:
rat netwire trojan
Link:
https://app.any.run/tasks/330a4d3f-5c5b-4ae7-bc2a-5a4f6d6905a5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
NetWire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/121926/
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Unauthorized injection to a recently created process
DNS request
Creating a window
Connection attempt
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/626526
Signature
Contains functionality to log keystrokes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NetWire
Uses dynamic DNS services
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98a046d5edb9540592c6b45a2efa070864637109894d8d831e804ba09bbbcbb4/
Threat name:
Win32.Trojan.SpyNoon
Create hunting rule
Status:
Malicious
First seen:
2021-03-03 18:01:05 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
30 of 47 (63.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tcqenvpnxfkalewgwrnc56qhbbsgg4ijrfgy3ay6qbf2bg53zo2a._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
1c1035301c27d73a161ca96f9732f5024eb924798ce95d76d274b751ff87aa2f
NetWire
3434bb383c8dd721266f60e07820474205d70c5da9ebb465109ace7894567437
NetWire
6ba5c67ab5a2f0905d5140b65b193d1062bcba3abb6e9755efe2a862f753cc95
NetWire
76947dcfe886fe0e3273c7723140533999741f239a2ad7568a460cae74bb0e50
NetWire
87c89f29aaa5dd79839585af00f1d29fa406e18ee341b23aa08f471b8c096f8b
NetWire
90dbd6dce0e0e7013656333f1cd8a9b7660e0e40e782a622856800c52e980d3e
NetWire
9105005851fbf7a7d757109cf697237c0766e6948c7d88089ac6cf25fe1e9b15
NetWire
c2382986d2bacaacd5399abca6ba33ee39fec2e9f331b8493a7511bc23578adc
NetWire
f5c3a4c6e9a672d984b794977cac7cc5ce38b6ab3c76bb79227217cc432a6ad9
NetWire
fefea87ebfbd43c789033d46905fd2a11b8ea9d4c6b57691f23a89e8f8687992
NetWire
+ 362 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet rat stealer
Link:
https://tria.ge/reports/210303-py98zbcfas/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
NetWire RAT payload
Netwire
Unpacked files
SH256 hash:
ef77383db4a0c6a607e9a7e7277f6b88d3707fcc6f20236ebe1566c172c4bbe7
MD5 hash:
ccd59bd49cbf34dd93dfbd7f2585caae
SHA1 hash:
6d6f7ca2a45a964a852c0aa2b7e5fff14bee27c5
Detections:
win_netwire_g1
Create hunting rule
win_netwire_auto
Create hunting rule
Link:
https://www.unpac.me/results/185f7e3e-c948-4924-a9a3-92a314b6d22c/
Parent samples :
328908f054c4a82ebcb35127b0e9c7924dcdb6c134b76f01b269a2dd23967b18
98a046d5edb9540592c6b45a2efa070864637109894d8d831e804ba09bbbcbb4
SH256 hash:
d6cccace73f285651d37cdc56d610ccd65ca6edca58ef5365b87c7793c268711
MD5 hash:
2e7a55cb521850f6e6ce7eae4f850f0c
SHA1 hash:
0de07a883c94319fe67616a7ccfc275b17192106
Link:
https://www.unpac.me/results/185f7e3e-c948-4924-a9a3-92a314b6d22c/
SH256 hash:
3b6e2cea254888eb090fe87c7051f58dd6750bb3c736dd42e2c5f39ef9d6d485
MD5 hash:
b3b393814f31eaf0b060c105ed5507f4
SHA1 hash:
1a7294860f437fa6ff113bfa7f471d8d51bcfcaa
Link:
https://www.unpac.me/results/185f7e3e-c948-4924-a9a3-92a314b6d22c/
SH256 hash:
98a046d5edb9540592c6b45a2efa070864637109894d8d831e804ba09bbbcbb4
MD5 hash:
754fd049502c2333dc04447b86a4f4b7
SHA1 hash:
357ca18d11d7d61b3826e47d8f69579d8909508a
Link:
https://www.unpac.me/results/185f7e3e-c948-4924-a9a3-92a314b6d22c/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/98a046d5edb9540592c6b45a2efa070864637109894d8d831e804ba09bbbcbb4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:MALWARE_Win_NetWire
Create hunting rule
Author:ditekSHen
Description:Detects NetWire RAT
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

img 3f0d72069b80382c88bdc864055d547bbb0b5e0f01edee6d950469a0646fbf51

NetWire

Executable exe 98a046d5edb9540592c6b45a2efa070864637109894d8d831e804ba09bbbcbb4

(this sample)

  
Dropped by
MD5 230c9dc6ada9d73f47e4f6f8c65a423c
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/121926/
  
Dropped by
SHA256 3f0d72069b80382c88bdc864055d547bbb0b5e0f01edee6d950469a0646fbf51

Comments