MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824
SHA3-384 hash: 4e5cbc93f6d196d1d86ff36560898340968ac10cd605f57214ddb1872d891494c6b396c80aeb1a54ff6035b3c6ba94df
SHA1 hash: 2a55286c66012cfb09151effabac6f8d54cc3ce1
MD5 hash: 1a53e9230ba3bbd5969cc4499baaacdd
humanhash: coffee-autumn-queen-comet
File name:SecuriteInfo.com.Trojan.DownLoader33.21294.20659.6330
Download: download sample
Signature NetWire
Create hunting rule
File size:126'976 bytes
First seen:2020-03-25 13:04:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f3c34fb22e1786c1971ec12dbbcaf5ff (1 x NetWire)
ssdeep 1536:P6yQ+RRdgWQIK9/5Cr+myjzUau0LSr4tPn:TvJK9BCyBLJp
Threatray 709 similar samples on MalwareBazaar
TLSH B2C34C23F520D815C89A1EBC8D96C5F90A23EC745E64DF877A013F5E2CF6362992A721
Reporter SecuriteInfoCom
Tags:NetWire

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Agent-7655139-0
Create hunting rule

Win.Malware.Generic-7640581-0
Create hunting rule

Win.Dropper.Agent-7725907-0
Create hunting rule

Result
Threat name:
NetWire GuLoader
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/332713
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
Win32.Trojan.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-03-25 09:57:02 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
25 of 30 (83.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xopenf5iuuh5dcvpyjw3wgpx2e7vdkgwkdlhkvpvbhs7bl7rxasa._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
guloader
Create hunting rule
Similar samples:
033ce6f96b137b9d18e2033b847c6718bee3beb197bc2ca2627cb7344f99b989
NetWire
32dab97f7d2978729426abf6fbb0f2a1fd360b7ff26be8e0fe6180c548f511d2
NetWire
49b7d5b70de07198665b902a0bb7404b3d9578895a9c90fa1d8f7b4a670278a3
NetWire
6901142f041abcfc97b29e0c77e99fb531e1ee2ea4e5287b0ec1105f8a58a68c
NetWire
7ae768f74862bcde7fb7c5be5168af751a0dd90f2d10ba006cfe285a38fa6e1f
NetWire
a71e14a3d15302daafb61efcd8a1cfebe0c72511cafc8a81f306e59f8866d942
NetWire
cc9ff6076aa53f001b0e0501055e511a7e161e66dc52745d45c7ee250b9b5cae
NetWire
e4c669ea3b39e4ee4f181dfc4772f7256d32b410dd69b9a76a1419cb2560edae
NetWire
e7fd55e17337f49ebe33c1fdacd6d126c0b478b2e0885785bdc1231a6c92f9f4
NetWire
e841806739d99bc20e9d0c66f4f253ced0e37829bdbc834fe3001c169d62ba7c
NetWire
+ 699 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NetWire

Executable exe bb9e4697a8a50fd18aafc26dbb19f7d13f51a8d650d67555f509e5f0aff1b824

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/329710/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::EVENT_SINK_AddRef

Comments