MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e1f4d1179a5aceeb71f0e122d2e48fdfcd76e0c4e92475bb54dff0d8f5edf59. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9e1f4d1179a5aceeb71f0e122d2e48fdfcd76e0c4e92475bb54dff0d8f5edf59
SHA3-384 hash: c518d331c9215c5416aff3debd1f2d8de25dd086ab9cecee50f10556121ea5608898ba2904f2d337efebd83751581a3c
SHA1 hash: ff14455ea77cbf04780b75056110ae8b4aba6546
MD5 hash: 5ccf7132bcb31bcf3c8b40aada170b82
humanhash: fifteen-alanine-michigan-high
File name:5ccf7132bcb31bcf3c8b40aada170b82.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:110'592 bytes
First seen:2020-05-23 15:34:08 UTC
Last seen:2020-05-23 15:46:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f7ba173974ed1b72d43da3a889d06d1b (1 x NetWire)
ssdeep 1536:B4xZO08TvYzKt6IfL82VclnLDBuCGLiS09DE7v8SAsY:BrFnnctDS50P
Threatray 293 similar samples on MalwareBazaar
TLSH 0FB30963B5D98CF1EE340F704A35EAA73D2BAC2519508F07B089BB8D15372CE687265D
Reporter abuse_ch
Tags:exe NetWire RAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
90
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.FareitVB-AB.7562.25601.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Vebzenpak
Create hunting rule
Status:
Malicious
First seen:
2020-05-23 14:12:20 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
guloader
Create hunting rule
Similar samples:
07f21e8acc3843aa44347b928c180902577a40850a8c671065920cb81ea8beb3
NetWire
10481c8ab9d363251e4d1aab4805df6d245621a5f10302fe5ed8cdd9f20bdc14
NetWire
1cd2e3b696656354859e0ffdb5bca866fadf42f59c9e2da1c228e0b52fa5f368
NetWire
44c7ef261a066790a4ce332afc634fb5f89f3273c0c908ec02ab666088b27757
NetWire
5ecd51e9131fb350b5fe5b90e4e4ebd71a28a55ca867399f231995e25097da58
NetWire
6ee45fdfe890e0199f1c72f05fd27218c358ddce153f85d4e683d3ba72dbc2d8
NetWire
74cfeab3123defd40a4efa419fcc77b17178c27b3b70b97972939f7a8d899957
NetWire
b022be4adc35569368e23da7b344c4f9a4ce9efffaf1013d1fc778cb2b58f67f
NetWire
d8f45655685ca97ed8764eb2aabca17f5037a5e5b65a1067cbfa37ba33614b6b
NetWire
e65a5fdf0fa896a90f1b817b341b982cc0ba0ade72ca3542234da82fddcc3143
NetWire
+ 283 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence
Link:
https://tria.ge/reports/201109-2djvc1kjke/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Suspicious use of NtSetInformationThreadHideFromDebugger
Suspicious use of SetThreadContext
Adds Run key to start application
Checks QEMU agent state file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Malicious_BAT_Strings
Create hunting rule
Author:Florian Roth
Description:Detects a string also used in Netwire RAT auxilliary
Reference:https://pastebin.com/8qaiyPxs
Rule name:MAL_unspecified_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects unspecified malware sample
Reference:Internal Research
Rule name:masslogger_gcch
Create hunting rule
Author:govcert_ch
Rule name:netwire
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect netwire in memory
Reference:internal research
Rule name:Suspicious_BAT_Strings
Create hunting rule
Author:Florian Roth
Description:Detects a string also used in Netwire RAT auxilliary
Reference:https://pastebin.com/8qaiyPxs
Rule name:win_asyncrat_j1
Create hunting rule
Author:Johannes Bader @viql
Description:detects AsyncRAT
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NetWire

Executable exe 9e1f4d1179a5aceeb71f0e122d2e48fdfcd76e0c4e92475bb54dff0d8f5edf59

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/367172/
  
Delivery method
Distributed via web download

Comments