MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b91e521a864bd5aabc0bf30b8f983adac9a873f16a7f20a8faa3e93f13fb435f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b91e521a864bd5aabc0bf30b8f983adac9a873f16a7f20a8faa3e93f13fb435f
SHA3-384 hash: 583af2a71875b33646bcb5f2c478c94b169e457e4f10b9ec8a898669f0709c6bef07015b6ebecb0444cd9f33c06913db
SHA1 hash: dbc3207af6e6ac2dc56a5c8f9992d8f797871726
MD5 hash: 873da2f0a6484669483a21597e1ac2c0
humanhash: high-red-low-lithium
File name:Server67hm.ps1
Download: download sample
Signature NetWire
Create hunting rule
File size:395'715 bytes
First seen:2022-04-12 17:26:44 UTC
Last seen:2022-04-13 04:25:53 UTC
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 6144:rZGyW4TYpV290gz4GezrBAEAfXgKlfGEEykaZorhWZiAVV:rZGyW4TYpV290ggWb4hWdV
Threatray 1'622 similar samples on MalwareBazaar
TLSH T11484A545F7ABFC0F50151D0C503A525BB92DAAF8B6EEC77358839237F0DA21606EB14A
Reporter pr0xylife
Tags:NetWire ps1

Intelligence

File Origin
# of uploads :
2
# of downloads :
541
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.VBS.Obfus-178.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6255b668eab80a7a6c025580/reports/0dde26a2-892f-465e-a572-a3fff6427ff0/overview
Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b91e521a864bd5aabc0bf30b8f983adac9a873f16a7f20a8faa3e93f13fb435f/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-04-12 17:27:07 UTC
File Type:
Text (PowerShell)
AV detection:
6 of 26 (23.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xepfegugjpk2vpal6mfy7gb23le2q47rnj7sbkh2uput6e73inpq._file
Verdict:
unknown
Similar samples:
0d9facf6b7073de4e3db19eb64e80589d98cfe35b66942191390a891bb8b241c
NetWire
3de53b4ea3e4c8c8522ca9fc9d38a1556cf645298b0fe18c937b0f307dba129f
NetWire
4b4bcdcc293f734c7504ef54fbc90c4399210a0617a8f25e5c660d5735b1d7dd
NetWire
70d04c9ec5f8c5f8a5c1cd82ad19eee2ddd26145848bc2ffe90d1b51645cac2e
NetWire
a78ceb0178abe8b1dbf87cd6c17fa2a2a10c34f4837b5f87b0e206f2a3d534a4
NetWire
c6fc9524fec2a6e2d2954d11b67a4d86a3c4a5672f21c388b1ab555e6fd09888
NetWire
cab0b398ecbf051d2fefcd25624c8f2b8119d52304c4e9836ede3b5391119fe6
NetWire
cdd4ab01797a178b70303381028cb419a8550a15fa75bdb40f6d56bc289b7dcf
NetWire
e4fdf5ead09b850c4e9de74f0a4bc7816e57a6ae1f8334f3222d46b0ac9bff15
NetWire
+ 1'612 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  10/10
Tags:
n/a
Link:
https://tria.ge/reports/220412-v1eb5shdf6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in System32 directory
Suspicious use of SetThreadContext
Process spawned unexpected child process
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/b91e521a864b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:SUSP_Scheduled_Tasks_Create_From_Susp_Dir
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects a PowerShell Script that creates a Scheduled Task that runs from an suspicious directory

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NetWire

PowerShell (PS) ps1 b91e521a864bd5aabc0bf30b8f983adac9a873f16a7f20a8faa3e93f13fb435f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2144424/
  
Delivery method
Distributed via web download

Comments