MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2d01f23413e651226add970b8737c03777c0e2717f13c4a4c4ee29231e8832e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 11

Intelligence 11 IOCs YARA 3 File information Comments

SHA256 hash:	c2d01f23413e651226add970b8737c03777c0e2717f13c4a4c4ee29231e8832e
SHA3-384 hash:	daa584ac46a0db3ed3c4a94beecaf450805983740fc7565cf66d178c3b2dbb594d13d5ac4d40eaa694a8cd95a89e0770
SHA1 hash:	a1222ad2f2dffe3653830d77e9ca67351092c4da
MD5 hash:	d7120901bf8033ec5fb936d7c5dc73bc
humanhash:	chicken-music-potato-apart
File name:	Payment notification.exe
Download:	download sample
Signature	NetWire Create hunting rule
File size:	488'448 bytes
First seen:	2021-02-11 10:07:38 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	12288:IcAe5yNg4oKliSPaXCmvszoFAh4m0oKka8ACJO1emA:r5uoGzyXXvsI3m0vd1
Threatray	351 similar samples on MalwareBazaar
TLSH	E5A4234C69A88321ED6567F9F13481A56B2A732B7C17CF1D2D69F0AD8B527C013238B7
Reporter	abuse_ch
Tags:	exe NetWire nVpn RAT

abuse_ch

Malspam distributing NetWire:

HELO: rdns0.templaterunner.art
Sending IP: 185.174.103.165
From: paymentemail@fnb.co.za
Reply-To: agood1708@gmail.com
Subject: Payment Notification
Attachment: Payment notification.r10 (contains "Payment notification.exe")

NetWire RAT C2:
194.5.97.50:3382

Hosted on nVpn:

% Information related to '194.5.97.0 - 194.5.97.255'

% Abuse contact for '194.5.97.0 - 194.5.97.255' is 'abuse@privacyfirst.sh'

inetnum: 194.5.97.0 - 194.5.97.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-UK5
country: GB
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
mnt-by: PRIVACYFIRST-MNT
status: SUB-ALLOCATED PA
created: 2018-07-23T09:31:45Z
last-modified: 2020-08-26T17:48:55Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

277

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Payment notification.exe

Verdict:

Malicious activity

Analysis date:

2021-02-11 10:18:30 UTC

Tags:

trojan netwire

Link:

https://app.any.run/tasks/9e283630-e363-4407-a0a8-b58e112ca1fd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Netwire

Link:

https://www.capesandbox.com/analysis/116782/

Detection(s):

SecuriteInfo.com.Trojan.Packed2.42845.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a custom TCP request

Sending a UDP request

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Unauthorized injection to a recently created process

Creating a file

Connection attempt

Enabling autorun by creating a file

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

NetWire

Detection:

malicious

Classification:

troj.spyw.evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/605650

Signature

Contains functionality to steal Chrome passwords or cookies

Executable has a suspicious name (potential lure to open the executable)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: NetWire

Sigma detected: Scheduled temp file as task from temp location

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected NetWire RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

netwire

Link:

https://mwdb.cert.pl/sample/c2d01f23413e651226add970b8737c03777c0e2717f13c4a4c4ee29231e8832e/

Threat name:

ByteCode-MSIL.Trojan.Woreflint

Status:

Malicious

First seen:

2021-02-11 10:38:10 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ylib6i2bhzsrejvn3fylq434an3xydrhc7ytyssmj3rjempiqmxa._file

Verdict:

malicious

Label(s):

netwirerc

Result

Malware family:

netwire

Score:

10/10

Tags:

family:netwire botnet rat stealer

Link:

https://tria.ge/reports/210211-3g82ymxkpj/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

NetWire RAT payload

Netwire

Unpacked files

SH256 hash:

2ec41720b412f91f91daaefea38007449491b2c016238aa8f23b6866c89bc788

MD5 hash:

987ce346069cf47535e5ac57265c7228

SHA1 hash:

d0085325ed78fcac6d1f605753237abd1c40db22

Link:

https://www.unpac.me/results/cea9f50a-a477-45d3-a4c0-9727f0557df3/

SH256 hash:

0557c8245fbbb0ba445aeb02f68b6b47a69ec2d1e7b33f663c349466f6db2bcb

MD5 hash:

7dbb494b648c40b64c5cbc560166d659

SHA1 hash:

940251f93d74276d34b50bf262d5a5e40ffc0015

Detections:

win_netwire_g1

win_netwire_auto

Link:

https://www.unpac.me/results/cea9f50a-a477-45d3-a4c0-9727f0557df3/

SH256 hash:

f16afd0ae3f556d2bd67253c1b75a8603253538b6f36e1a371c5e8bde09ac219

MD5 hash:

0ae8c468d312a550f6e1e1ae3e6bfbb6

SHA1 hash:

83575448dd7decd71fec618fa5800c7c80a04097

Link:

https://www.unpac.me/results/cea9f50a-a477-45d3-a4c0-9727f0557df3/

SH256 hash:

c2d01f23413e651226add970b8737c03777c0e2717f13c4a4c4ee29231e8832e

MD5 hash:

d7120901bf8033ec5fb936d7c5dc73bc

SHA1 hash:

a1222ad2f2dffe3653830d77e9ca67351092c4da

Link:

https://www.unpac.me/results/cea9f50a-a477-45d3-a4c0-9727f0557df3/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	IPPort_combo_mem Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	win_netwire_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator