MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bdfb906a3a02d8a28bef1d13d0abff090bc9582373e05e5f376186e9a7c5a902. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bdfb906a3a02d8a28bef1d13d0abff090bc9582373e05e5f376186e9a7c5a902
SHA3-384 hash: 29a970be253a6cf9d469b439a77d29d9a4126312b6647abcebe7c2186f3b994b9a128781c32b314355e314f43da73ec9
SHA1 hash: 4f7c2447d738c18e70160fb12a66e3b8913e8594
MD5 hash: f36dbd08d89de65427f8f2474507c89c
humanhash: zebra-uniform-comet-virginia
File name:parcel.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:397'105 bytes
First seen:2021-03-04 07:26:00 UTC
Last seen:2021-03-04 09:09:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b76363e9cb88bf9390860da8e50999d2 (464 x Formbook, 184 x AgentTesla, 122 x SnakeKeylogger)
ssdeep 6144:N8LxB7zyxitFJGC5zaNuvX8+TBzAKMoMzTz5bMlFl:wltGC5zaEvXPA6M7AFl
Threatray 377 similar samples on MalwareBazaar
TLSH 7B849C13EEB2ED73C6F576FB0059B5299D2E4E910CF27586626CB549FEB3D42C900182
Reporter abuse_ch
Tags:DHL exe NetWire RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: dns13784.phdns20.es
Sending IP: 185.45.75.217
From: DHL International GmbH <noreply@worldwidedhl.com>
Subject: DHL EXPRESS PO#R2019416***** RE-DELIVERY NOTICE!
Attachment: parcel.img (contains "parcel.exe")

NetWire RAT C2:
goryhazel1.duckdns.org

Intelligence

File Origin
# of uploads :
2
# of downloads :
389
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
parcel.exe
Verdict:
Malicious activity
Analysis date:
2021-03-04 07:28:38 UTC
Tags:
rat netwire trojan
Link:
https://app.any.run/tasks/320ae1f3-0dac-4c4e-93f5-f905070bfac8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
NetWire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/122188/
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Unauthorized injection to a recently created process
DNS request
Creating a window
Sending a custom TCP request
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/628221
Signature
Contains functionality to log keystrokes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NetWire
Uses dynamic DNS services
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bdfb906a3a02d8a28bef1d13d0abff090bc9582373e05e5f376186e9a7c5a902/
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2021-03-04 07:09:33 UTC
AV detection:
23 of 48 (47.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xx5za2r2almkfc7pduj5bk77bef4swbdopqf4xzxmgdotj6fveba._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
1c1035301c27d73a161ca96f9732f5024eb924798ce95d76d274b751ff87aa2f
NetWire
3434bb383c8dd721266f60e07820474205d70c5da9ebb465109ace7894567437
NetWire
6ba5c67ab5a2f0905d5140b65b193d1062bcba3abb6e9755efe2a862f753cc95
NetWire
76947dcfe886fe0e3273c7723140533999741f239a2ad7568a460cae74bb0e50
NetWire
87c89f29aaa5dd79839585af00f1d29fa406e18ee341b23aa08f471b8c096f8b
NetWire
90dbd6dce0e0e7013656333f1cd8a9b7660e0e40e782a622856800c52e980d3e
NetWire
9fedb9fe35eae9739d319565aed4cbd16325242f8815cdf21d12d02e5601109d
NetWire
c2382986d2bacaacd5399abca6ba33ee39fec2e9f331b8493a7511bc23578adc
NetWire
f5c3a4c6e9a672d984b794977cac7cc5ce38b6ab3c76bb79227217cc432a6ad9
NetWire
fefea87ebfbd43c789033d46905fd2a11b8ea9d4c6b57691f23a89e8f8687992
NetWire
+ 367 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet rat stealer
Link:
https://tria.ge/reports/210304-r452sltqc6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Loads dropped DLL
NetWire RAT payload
Netwire
Unpacked files
SH256 hash:
24af4063623c98e0f7a769a3d45bb4e2cec688cbab20f2217f10dd2616255d0e
MD5 hash:
f03a3d2a74a40577e0fd17089605e204
SHA1 hash:
b5e32b6792ac01ab485601d6f102c5b4345fb246
Detections:
win_netwire_g1
Create hunting rule
win_netwire_auto
Create hunting rule
Link:
https://www.unpac.me/results/3846bfd6-6029-4d38-b1c8-3f4188f5ecae/
Parent samples :
9fedb9fe35eae9739d319565aed4cbd16325242f8815cdf21d12d02e5601109d
bdfb906a3a02d8a28bef1d13d0abff090bc9582373e05e5f376186e9a7c5a902
31a804fddf5f1ed1d5c1a69772bc92026f90696a6903a3a7ebaf7aef6dfa9478
SH256 hash:
6cf21c1c265c9581c745d1d5c65e3dbf83ef30b5df9825945e3385f15d556736
MD5 hash:
3bd3e48281de6267fdc3e708d754ecc5
SHA1 hash:
9853bb95bae272b1529a0faf40061b8d89a96e7d
Link:
https://www.unpac.me/results/3846bfd6-6029-4d38-b1c8-3f4188f5ecae/
SH256 hash:
f05f84a79ee44d8ca12f9751329114536dde326e15c135b64f0ee89ac5284c2a
MD5 hash:
f93e83c6a7432aa29d6954e377d9a3b8
SHA1 hash:
e05dde932c3cca81f48d8be0549646f46ab8d4b2
Link:
https://www.unpac.me/results/3846bfd6-6029-4d38-b1c8-3f4188f5ecae/
SH256 hash:
bdfb906a3a02d8a28bef1d13d0abff090bc9582373e05e5f376186e9a7c5a902
MD5 hash:
f36dbd08d89de65427f8f2474507c89c
SHA1 hash:
4f7c2447d738c18e70160fb12a66e3b8913e8594
Link:
https://www.unpac.me/results/3846bfd6-6029-4d38-b1c8-3f4188f5ecae/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Eldorado
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/bdfb906a3a02d8a28bef1d13d0abff090bc9582373e05e5f376186e9a7c5a902

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:MALWARE_Win_NetWire
Create hunting rule
Author:ditekSHen
Description:Detects NetWire RAT
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

img 82ab4f5e87b083d6193bb24edc74780e858650cb2f7ef7a9f185b40b47f6bb69

NetWire

Executable exe bdfb906a3a02d8a28bef1d13d0abff090bc9582373e05e5f376186e9a7c5a902

(this sample)

  
Dropped by
MD5 912bf1def4943604c3e06feca9058073
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/122188/
  
Dropped by
SHA256 82ab4f5e87b083d6193bb24edc74780e858650cb2f7ef7a9f185b40b47f6bb69

Comments