MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b16b3d99441f078e081e2ac0a8f0121ce4dab264bf434e353d1e00a57e54d3aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b16b3d99441f078e081e2ac0a8f0121ce4dab264bf434e353d1e00a57e54d3aa
SHA3-384 hash: 06d2161866eb1f30604d010ea9e7155e684d98f59938e29823eff10cef8fae519fe645b978af8b51b12ac74bf82f34ae
SHA1 hash: 2c845f8e11a1c90de05c8dda65062c3c46678623
MD5 hash: 91506bc2a51501164b6a2b0c18ad1c44
humanhash: paris-oxygen-kansas-stream
File name:solut.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:1'467'736 bytes
First seen:2020-07-24 21:21:39 UTC
Last seen:2020-08-02 07:34:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 861932777c6b8f414ab4a2b3b218c721 (1 x NetWire)
ssdeep 24576:AcYEUIXB/cAK+gBFn1Tr/J2m6DnLrJ+5QuNec2WjF4dRLnP4Nb5LnviKxm/2Ci0j:QEUIXB/cH5BF1H/Jb5QuNec7AWRvLm+y
Threatray 238 similar samples on MalwareBazaar
TLSH 99659D13B1418271C0E32178816E3332277DEEB057659BC722A4FAB5AD722D06F75ADB
Reporter malware_traffic
Tags:exe NetWire NetwireRAT RAT

Intelligence

File Origin
# of uploads :
4
# of downloads :
354
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/32283/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader34.4790.4412.7983.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Connection attempt to an infection source
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/397741
Behaviour
Behavior Graph:
Download SVG
Detection:
netwire
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b16b3d99441f078e081e2ac0a8f0121ce4dab264bf434e353d1e00a57e54d3aa/
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2020-07-24 21:23:05 UTC
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wfvt3gked4dy4ca6flakr4asdtsnvmtex5bu4nj5dyakk7su2ova._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
0c34d4763fc968ccbe9f33dec2ae9e3e132a61b40ffc93cc22f337a0758c0279
NetWire
3e9f05acde528ea5fd7ca9d0c2af0e82d29e343d2f61420290e6f660630cd25f
NetWire
4e52cdd00c05814d563b70e3271df67fb530ec90dca084a4f1b4d3f539e58061
NetWire
573f11821c72786131d82bcdb3744b83d01615c25489f4cf2c46181ae6143226
NetWire
8f9f4cc3a0403e5c2522726849e8a2033d72fc7f36b2317bc9fb86808c1693ec
NetWire
b0a98ae8b1dadc3b181f6252abef59940ceeb5019cd4ae2f0feadb0a520063cd
NetWire
b6f5a289ab47b790c1bc57a5a3b35871fc968da66ebb3fdd7669de18c2ba3dd5
NetWire
c1ffaaa3fad1741534ca46e6eb19dbafebc46932eecccef600f69a615d8e57ea
NetWire
df2688f6f88ea0e66b46d856e514adf25f8456cb4e45c849233799e17b1171e3
NetWire
f09dc0b3275b4c1e3a616911805011c2871af1407599493dc980b6987cb313eb
NetWire
+ 228 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
persistence botnet stealer family:netwire
Link:
https://tria.ge/reports/200724-c4my8pf2gs/
Behaviour
Suspicious use of WriteProcessMemory
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Netwire
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Weecnaw
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b16b3d99441f078e081e2ac0a8f0121ce4dab264bf434e353d1e00a57e54d3aa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator
Rule name:win_netwire_g1
Create hunting rule
Author:Slavo Greminger, SWITCH-CERT

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NetWire

Executable exe b16b3d99441f078e081e2ac0a8f0121ce4dab264bf434e353d1e00a57e54d3aa

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/419020/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/32283/

Comments