MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be7fe47c7a1e41aae011a874a00fad891b92ff9a8c7262d22ea332d418e338ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be7fe47c7a1e41aae011a874a00fad891b92ff9a8c7262d22ea332d418e338ae
SHA3-384 hash: ab51574203a185804c0095e33725a1c412083b7b168c2ae8f68ff655afc187913a6c611e36802d56080ab15bb5e177f4
SHA1 hash: 4ad0d0f86e2d512177b1096ab1508a6a04ee1af6
MD5 hash: 39d8fad186b52c3a3b73ff8d2c57fc80
humanhash: summer-oranges-ohio-apart
File name:39d8fad186b52c3a3b73ff8d2c57fc80
Download: download sample
Signature NetWire
Create hunting rule
File size:419'840 bytes
First seen:2020-11-17 11:45:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 6144:UpplpRdBHMlU8LFPwJnsgcDIGyBV1pUdehchMPdo9bgCIm06ShTzA43K2jvHskc:wZt8LF0nFsIQQq8G0k20H
TLSH 4F94F13265D2AD96E7AB1F74E16227881FB87D2B9B20E51D3E9C018D2172F49CB10F71
Reporter seifreed
Tags:NetWire

Intelligence

File Origin
# of uploads :
1
# of downloads :
261
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Taskun-9791093-0
Create hunting rule

Win.Packed.Generickdz-9792504-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Connection attempt
Enabling autorun by creating a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be7fe47c7a1e41aae011a874a00fad891b92ff9a8c7262d22ea332d418e338ae/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 08:43:16 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xz76i7d2dza2vyarvb2kad5nrenzf742rrzgfuroumznighdhcxa._file
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet persistence rat stealer
Link:
https://tria.ge/reports/201117-22gq8j7g76/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Modifies service
Suspicious use of SetThreadContext
NetWire RAT payload
Netwire
Unpacked files
SH256 hash:
be7fe47c7a1e41aae011a874a00fad891b92ff9a8c7262d22ea332d418e338ae
MD5 hash:
39d8fad186b52c3a3b73ff8d2c57fc80
SHA1 hash:
4ad0d0f86e2d512177b1096ab1508a6a04ee1af6
Link:
https://www.unpac.me/results/7afb1342-812d-4f0d-acf0-ad0618c4d33c/
SH256 hash:
cb951f1d2b5460456aad0d89cef1216d9be5e51784d11a92447d43e96177bd5e
MD5 hash:
8cd5d2014866f4ef60802ff1826998a6
SHA1 hash:
8ff75946905d0b117080cc5a07e6e0bbea4e9bbd
Link:
https://www.unpac.me/results/7afb1342-812d-4f0d-acf0-ad0618c4d33c/
SH256 hash:
6d5f7f4785e4d7ffac05a3f6979b20683487806378b976cd0cfaa1a1fd3c7f81
MD5 hash:
97781c25df5d1b2511b1bcf2dc75f8c8
SHA1 hash:
b3a18b84d39f14795127c872ce03a08f040844b0
Link:
https://www.unpac.me/results/7afb1342-812d-4f0d-acf0-ad0618c4d33c/
SH256 hash:
d68b7bb6fb26658991921e4caeaa42d6061e36e5539802466cabb521c57a41fe
MD5 hash:
526d823bee38e490f07891fa8f4a6e85
SHA1 hash:
d9fa67af4530cbcbb48411b284f37c256c99dda5
Detections:
win_netwire_g1
Create hunting rule
win_netwire_auto
Create hunting rule
Link:
https://www.unpac.me/results/7afb1342-812d-4f0d-acf0-ad0618c4d33c/
Parent samples :
be7fe47c7a1e41aae011a874a00fad891b92ff9a8c7262d22ea332d418e338ae
060ef35b985d05b93d0e647a68cdbb83d651a8b5fb36b234c94f3181d2d30aa3
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments