MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4b73299f51cc04c30ee6080144f960c8d5de3d62c0e0b10c6c497f57b844474. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 11


Intelligence 11 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c4b73299f51cc04c30ee6080144f960c8d5de3d62c0e0b10c6c497f57b844474
SHA3-384 hash: 179a2b1bbd1ef2925bd37f634862fec7744479ff7d7cb12d20bda56a1b08faf27fafe5631a220a6c8908fa9682d42bf7
SHA1 hash: 735550593e99598922ed6ed22c82de8af97500c6
MD5 hash: eaadb61aedffaa518654f85da7985f1d
humanhash: rugby-zulu-tennis-pip
File name:SKM_30821021607250.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:805'840 bytes
First seen:2021-03-17 13:08:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b90bc808c51feebc3ce9af2d0f78a9a3 (1 x NetWire, 1 x FormBook)
ssdeep 12288:s80FuWQTmjQ1i7PNNQH1WKhFH4UnhBlcY7/uQr7UK+:B0cCQ1iBNbK/DT3W0+
Threatray 395 similar samples on MalwareBazaar
TLSH 71055A21E1F04436C3635A38F85676647D26BE111FA8A97737AC6C089F38F93FA19193
Reporter James_inthe_box
Tags:exe NetWire signed

Code Signing Certificate

Organisation:BINDOX
Issuer:BINDOX
Algorithm:sha1WithRSA
Valid from:2021-03-16T17:50:36Z
Valid to:2039-12-31T23:59:59Z
Serial number: 11a9bf6b2dcbc683475b431a1c79133e
Thumbprint Algorithm:SHA256
Thumbprint: e7db279cad60633b1f05d8eefabc9cec52f6402590ea55690bebe40a12fc02f2
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
419
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SKM_30821021607250.exe
Verdict:
Malicious activity
Analysis date:
2021-03-17 13:15:49 UTC
Tags:
trojan netwire
Link:
https://app.any.run/tasks/a010bedd-30db-4d3e-89f6-b628817795e8

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/124559/
Detection(s):
Win.Dropper.Fareit-9838621-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
DNS request
Sending a custom TCP request
Creating a file
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/642268
Signature
Contains functionality to log keystrokes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Internet Explorer form passwords
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Executables Started in Suspicious Folder
Sigma detected: Execution in Non-Executable Folder
Sigma detected: NetWire
Sigma detected: Suspicious Program Location Process Starts
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 370106 Sample: SKM_30821021607250.exe Startdate: 17/03/2021 Architecture: WINDOWS Score: 100 40 Malicious sample detected (through community Yara rule) 2->40 42 Multi AV Scanner detection for submitted file 2->42 44 Yara detected NetWire RAT 2->44 46 5 other signatures 2->46 6 Jndhsjsud.exe 2->6         started        10 SKM_30821021607250.exe 1 3 2->10         started        13 Jndhsjsud.exe 2->13         started        process3 dnsIp4 26 onedrive.live.com 6->26 36 2 other IPs or domains 6->36 48 Multi AV Scanner detection for dropped file 6->48 50 Detected unpacking (changes PE section rights) 6->50 52 Detected unpacking (overwrites its own PE header) 6->52 54 Machine Learning detection for dropped file 6->54 15 Jndhsjsud.exe 2 6->15         started        28 onedrive.live.com 10->28 30 db-files.fe.1drv.com 10->30 32 9zp3lg.db.files.1drv.com 10->32 22 C:\Users\Public\Jndhsj\Jndhsjsud.exe, PE32 10->22 dropped 56 Contains functionality to log keystrokes 10->56 58 Contains functionality to steal Internet Explorer form passwords 10->58 60 Contains functionality to steal Chrome passwords or cookies 10->60 17 SKM_30821021607250.exe 2 10->17         started        34 onedrive.live.com 13->34 38 2 other IPs or domains 13->38 62 Injects a PE file into a foreign processes 13->62 20 Jndhsjsud.exe 13->20         started        file5 signatures6 process7 dnsIp8 24 103.150.8.54, 3360, 49727, 49748 XTOM-AS-JPxTomJP unknown 17->24
Detection:
netwire
Create hunting rule
Link:
https://mwdb.cert.pl/sample/c4b73299f51cc04c30ee6080144f960c8d5de3d62c0e0b10c6c497f57b844474/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-17 02:21:56 UTC
File Type:
PE (Exe)
Extracted files:
49
AV detection:
31 of 47 (65.96%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ys3tfgpvdtaeymhomcabit4wbsgv3y6wfqhaweggysl7k64eir2a._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
151f57078e89aa2f81fcb307bf88fe23e9f2437a4df1e37def5d0b78797e12f8
NetWire
2e54ae1fe78471492cc217d238fcd7f0158ae8f22a35e9576a91b3a6614c2d08
NetWire
2e5d08e10497cdd14499b4ae823f7d639a738d37784882db758e70fa3804e4e9
NetWire
5f8cd119c7cc31eef0e66451fb05d5179c60850b2330ebcb76066dd289172a17
NetWire
6bcd9c589b51cbd1011942b2bdaeaab62748c7380a17336b35bf589c880553b8
NetWire
7b9a1aa88be62eb638af26146fce0a1b71aec646d2495fb350dd6d56997e7582
NetWire
af9cd43a93f367a04bfc05abe54327de1bbd7857ca85e1665828d557d6459b62
NetWire
d88b21c1b67f0aee44019a8b54a72d1662ae3c2939ff593fe0d1844cf17a5c53
NetWire
df2688f6f88ea0e66b46d856e514adf25f8456cb4e45c849233799e17b1171e3
NetWire
fadc99d77a3c3f3483b63596d5ead642ecafb0bb52342c975efdbfd26a87f166
NetWire
+ 385 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet persistence rat stealer
Link:
https://tria.ge/reports/210317-zwjwzknt6s/
Behaviour
Script User-Agent
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
NetWire RAT payload
Netwire
Unpacked files
SH256 hash:
c4b73299f51cc04c30ee6080144f960c8d5de3d62c0e0b10c6c497f57b844474
MD5 hash:
eaadb61aedffaa518654f85da7985f1d
SHA1 hash:
735550593e99598922ed6ed22c82de8af97500c6
Link:
https://www.unpac.me/results/9fafe82b-9954-42f1-9b25-31374727e08e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c4b73299f51cc04c30ee6080144f960c8d5de3d62c0e0b10c6c497f57b844474

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Chrome_stealer_bin_mem
Create hunting rule
Author:James_inthe_box
Description:Chrome in files like avemaria
Rule name:IPPort_combo_mem
Create hunting rule
Author:James_inthe_box
Description:IP and port combo
Rule name:MALWARE_Win_NetWire
Create hunting rule
Author:ditekSHen
Description:Detects NetWire RAT
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/124559/

Comments