MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9efeacb28688b709ed2b817977d8ace64b4b4674f5540f282017c78a32755145. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9efeacb28688b709ed2b817977d8ace64b4b4674f5540f282017c78a32755145
SHA3-384 hash: 834606cbdeb9d1dca1c110fdb5fc8812f0b54f4aed9efcca9a06d3923e11fa3f0fe3f7887f9eae26d493f879215e79e3
SHA1 hash: dc687350204d42353ecafc0ef60c0a7132132617
MD5 hash: cd32844eb5497ed952b846fa20d26aa8
humanhash: solar-tennessee-purple-cold
File name:utasarmsinc.ru_live__dew006.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:565'248 bytes
First seen:2020-03-18 19:22:03 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash bbbb2eb5f4f3ac85883c5a41d44d39c5 (1 x NetWire)
ssdeep 6144:q6RU5XGKFuQY59nALP3csCy/wtl/dJVXV2U3VEWRj5ij:Vi5XGK+issJotljtJFEYj0j
Threatray 4'818 similar samples on MalwareBazaar
TLSH A6C4597DE63C5426F89C81333AD0C9F654F65C28653240CA3CBE7B929EB7A5D6F85802
Reporter ov3rflow1
Tags:exe NetWire

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject3.6524.8522.16652.UNOFFICIAL
Create hunting rule

Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad.spyw.
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/23706
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2018-03-17 17:16:00 UTC
File Type:
PE (Exe)
Extracted files:
12
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
1986f889787d4d457678e2e1985b379d0b6990ed5b8ed713682d8378b9bc293d
NetWire
20e5edeac32212fe8dcc9e5ab6f872d7e647e5e78eb707f2e0704817e3c092e0
NetWire
2ea74bf397854358ce0363ce3176f0c0dc40ac0efb6f378422e2d72c8c078372
NetWire
2ff76dce8a2f9ea8d6904b9705447ff3fb45e77fa32a3f2c446f318b4aee2148
NetWire
38bb0a1d49eb96f7fae4e2e6831184522114744b354fd2b299eafc3d76bc7a62
NetWire
8d703de189a2ba36e099a2276e2ba596d40c54c21eec779286667e8dd6c2e5b8
NetWire
99737bd60422defc150edf7e1ec863acd6d2e599e8139aa987b6b4c43ab18cec
NetWire
9f10a3e22fd6722a29b863e9ab03a41234d3339414331bb074226dcc3195d610
NetWire
d0c571182eb67023db9b2f8c440dfc76488b23ea51819de40bbeca16fbb9322e
NetWire
e3212a19bbf13d1e8c9d6c80be5dedd5ce5d13acfd276d8a1c29370d500196bd
NetWire
+ 4'808 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9efeacb28688b709ed2b817977d8ace64b4b4674f5540f282017c78a32755145

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/227/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaSetSystemError
MSVBVM60.DLL::__vbaObjSetAddref
MSVBVM60.DLL::EVENT_SINK_AddRef
MSVBVM60.DLL::__vbaErrorOverflow

Comments