MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5552237bf0ede9675b646aea11141c7763ed882fc8dbfe1b036f6347fe98ad3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5552237bf0ede9675b646aea11141c7763ed882fc8dbfe1b036f6347fe98ad3
SHA3-384 hash: ac6ea83a7dc89e312ce45e7b8ad6e3e32067284726f9c686ca5ba197893579f1be8fc397c742d60acfe245feafe98ea7
SHA1 hash: 3596126e49ff1ca312b8a2c036976d6f44a5cdbf
MD5 hash: b48f191956b17605899eec0ae1ae255e
humanhash: burger-butter-eleven-minnesota
File name:PAY-IN-006.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:506'891 bytes
First seen:2022-02-28 09:10:55 UTC
Last seen:2022-02-28 11:03:45 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 6144:IGiZdPcmSA8PTFZ95of0ZcG6g/TQ6nLnxXx0ME/vG0o+srNodb0FA+/yYNqnTU:gdPcmSAQhZ95E0X9xhUm0+N12+/yYKU
Threatray 43 similar samples on MalwareBazaar
TLSH T137B48CC5EA4195B6D54B5630267CBE2A4A29AFF4306CCB1448EC3C5B7D30B1D36A3DA3
File icon (PE):PE icon
dhash icon 6ce0d2d6d2d2c4dc (3 x NetWire, 3 x NanoCore, 1 x RedLineStealer)
Reporter abuse_ch
Tags:exe NetWire RAT


Avatar
abuse_ch
NetWire C2:
194.147.140.14:4550

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
194.147.140.14:4550 https://threatfox.abuse.ch/ioc/391224/

Intelligence

File Origin
# of uploads :
2
# of downloads :
360
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NetWire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/245254/
Detection(s):
SecuriteInfo.com.MemScan.Trojan.Agent.FTAU.26243.22238.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Сreating synchronization primitives
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/621c91aab94fb38cb422e5bb/reports/6149afee-1487-4949-afd1-5021808d8c46/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/947234
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Internet Explorer form passwords
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Injects a PE file into a foreign processes
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: NetWire RAT Registry Key
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 579714 Sample: PAY-IN-006.exe Startdate: 28/02/2022 Architecture: WINDOWS Score: 100 34 Found malware configuration 2->34 36 Malicious sample detected (through community Yara rule) 2->36 38 Antivirus detection for URL or domain 2->38 40 6 other signatures 2->40 7 PAY-IN-006.exe 18 2->7         started        10 sjdyafkdcai.exe 2->10         started        12 sjdyafkdcai.exe 2->12         started        process3 file4 26 C:\Users\user\AppData\...\ovxufjxjbx.exe, PE32 7->26 dropped 28 C:\Users\user\AppData\Local\...\c189f3vigcx5c, DOS 7->28 dropped 14 ovxufjxjbx.exe 1 2 7->14         started        18 WerFault.exe 23 9 10->18         started        20 WerFault.exe 2 9 12->20         started        process5 file6 30 C:\Users\user\AppData\...\sjdyafkdcai.exe, PE32 14->30 dropped 46 Contains functionality to log keystrokes 14->46 48 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 14->48 50 Contains functionality to steal Internet Explorer form passwords 14->50 52 2 other signatures 14->52 22 ovxufjxjbx.exe 2 14->22         started        signatures7 process8 dnsIp9 32 194.147.140.14, 4550, 49757 PTPEU unknown 22->32 42 Tries to steal Mail credentials (via file / registry access) 22->42 44 Tries to harvest and steal browser information (history, passwords, etc) 22->44 signatures10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5552237bf0ede9675b646aea11141c7763ed882fc8dbfe1b036f6347fe98ad3/
Threat name:
Win32.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2022-02-28 09:11:10 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
21 of 27 (77.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uvksen57b3pjm5nwi2xkcekby53d5wec7sg37ynqg33di77jrljq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
03dcc84a1b2387ef18e82b9deeaa45da311890d27b3d28d022d43924201b7bcc
NetWire
060231c7729f65f39c1cc05fbe097d9c872dabd9391cc20eaf60c8d3c3cb0b5a
NetWire
1d54082d540ab23f276aafeb6bad1b8c7b0c435fc539dcda3be3f6423da0d8f4
NetWire
3cc9ec44e7516c0db0a27794c540fcc5a0c6d322821debaee8bd4d0a1231b4df
NetWire
e4715658b6981b37c06e063e6b59af6d82c8c5edeb93e339e367d497332b7b69
NetWire
e748f3e105a9370ec194134350c352b1a2c12cdf43be16e5804e4eb12ab39c13
NetWire
e83b81147f0b08a09751772c75cdec2522f2fce19b1f035a2ddc415f633dd2e0
NetWire
ec151e8b6c21fa0d0ed0550629a8421c797635dcdc8662454c37e3f25a41e9f1
NetWire
+ 33 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet persistence rat stealer
Link:
https://tria.ge/reports/220228-k5l8fadhb4/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
NetWire RAT payload
Netwire
Malware Config
C2 Extraction:
194.147.140.14:4550
Unpacked files
SH256 hash:
a8dde87c6311e0692b210437c9f76f57dbdc786276d79c3a27d21bd431d2d5fc
MD5 hash:
c4d66baae6a7dd0227cae66fa73ce16c
SHA1 hash:
f3fc5f04a37a4194d74cd86e0b4255d64daa6119
Detections:
win_netwire_g1
Create hunting rule
Link:
https://www.unpac.me/results/9b39fb34-c695-40fa-85e1-48da6b899d61/
Parent samples :
ec151e8b6c21fa0d0ed0550629a8421c797635dcdc8662454c37e3f25a41e9f1
a5552237bf0ede9675b646aea11141c7763ed882fc8dbfe1b036f6347fe98ad3
818bed3da07ea9e48989e4d61e6190df849ada635bfdc53ce86544a2deaa8ef0
9b697bd07f78c00751511ba619ba1a018d3628378d7e2d6c7ba35ceb9e99cac4
SH256 hash:
3058527607e7cba0c4c1e5c5195b1db11898dae1fedd39c45255871da0c2a6ff
MD5 hash:
b71cd76dee505d8c2e7da40d137a333c
SHA1 hash:
29db72bb8d7b46d9f960d8e2b910b757692e2e42
Link:
https://www.unpac.me/results/9b39fb34-c695-40fa-85e1-48da6b899d61/
SH256 hash:
a5552237bf0ede9675b646aea11141c7763ed882fc8dbfe1b036f6347fe98ad3
MD5 hash:
b48f191956b17605899eec0ae1ae255e
SHA1 hash:
3596126e49ff1ca312b8a2c036976d6f44a5cdbf
Link:
https://www.unpac.me/results/9b39fb34-c695-40fa-85e1-48da6b899d61/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a5552237bf0ede9675b646aea11141c7763ed882fc8dbfe1b036f6347fe98ad3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Binary_References_Browsers
Create hunting rule
Author:ditekSHen
Description:Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.
Rule name:MALWARE_Win_NetWire
Create hunting rule
Author:ditekSHen
Description:Detects NetWire RAT
Rule name:MAL_unspecified_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects unspecified malware sample
Reference:Internal Research
Rule name:MAL_unspecified_Jan18_1_RID2F4A
Create hunting rule
Author:Florian Roth
Description:Detects unspecified malware sample
Reference:Internal Research
Rule name:win_netwire_w0
Create hunting rule
Author:Jean-Philippe Teissier / @Jipe_
Description:NetWiredRC

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/245254/

Comments