MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d08f75542680080f9d3393fc3bb0ced3c30335db5030c1f38a8d7a7aadb15794. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 15

Intelligence 15 IOCs YARA 2 File information Comments

SHA256 hash:	d08f75542680080f9d3393fc3bb0ced3c30335db5030c1f38a8d7a7aadb15794
SHA3-384 hash:	ca217f934b847c7d45f65b1a624ddde4ccb929d76b45149cfb56a8545fa48bf3441fca976f6b5c197ed2ba58c5a11f3b
SHA1 hash:	16ad7f314c9c2742886523ac256fbb4a5f4bfdb0
MD5 hash:	c1ca174fbfc7936f8d9d0aad755f29cf
humanhash:	three-grey-london-table
File name:	IM202208.EXE
Download:	download sample
Signature	NetWire Create hunting rule
File size:	744'448 bytes
First seen:	2022-08-19 09:01:00 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'661 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:YcmeuEHslgDaK6nyfAt1eDFZByVxc/Njaw7lTUnCPIvFWzkGI+3mSaEy2eeKA:YCuCMuw1eDV84Njaw7laCPIFDum+y2eN
Threatray	911 similar samples on MalwareBazaar
TLSH	T199F401A1366C9791C0EA0BF51895CF0853B17CE3E92EEE09ADD1F1CA2631751CA81B5F
TrID	64.2% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 11.5% (.SCR) Windows screen saver (13101/52/3) 9.2% (.EXE) Win64 Executable (generic) (10523/12/4) 5.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.9% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter	cocaman
Tags:	exe INVOICE NetWire

Intelligence

File Origin

# of uploads :

# of downloads :

438

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

netwire

ID:

File name:

IM202208.EXE

Verdict:

Malicious activity

Analysis date:

2022-08-19 09:04:01 UTC

Tags:

trojan netwire rat

Link:

https://app.any.run/tasks/b3293cba-7aff-4e87-8c75-71b3fa8659e3

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/299752/

Detection(s):

SecuriteInfo.com.Trojan.PackedNET.1496.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Launching a process

Creating a process with a hidden window

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/62ff51c8eb0bf1e2c6ee82a6/reports/b9895fbd-f116-4329-9bde-1b578c9c9acb/overview

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

NetWire RAT

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7f8985ba-15ea-4c7b-a11a-fff76d7171e8

Result

Threat name:

NetWire

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1054297

Signature

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM3

Yara detected Netwire RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

netwire

Link:

https://mwdb.cert.pl/sample/d08f75542680080f9d3393fc3bb0ced3c30335db5030c1f38a8d7a7aadb15794/

Threat name:

ByteCode-MSIL.Trojan.Leonem

Status:

Malicious

First seen:

2022-08-19 09:02:37 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

20 of 26 (76.92%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=2chxkvbgqaea7hjtsp6dxmgo2pbqgno3kaymd44krv5hvlnrk6ka._file

Verdict:

malicious

Label(s):

netwirerc

NetWire

62fad464154b7411f1e5b993edafd111638f2b0770ffe1f6cfc166ae6b8404d9

NetWire

6ace19befa598ac3913865abf5fea0eac3d66b77425a9700274094d58b50630f

NetWire

73cc33d200ce22012733ea7c3fa8d03ef3ea65164497314d7d05b2992892d4e0

NetWire

90bb157f9c5241f567eb56be38e3ba9f51a0ec5a8da3c77fdb1bed1f2095c39b

NetWire

99b13841abbf0c2bf736ab08e0e7f48cd28cab2e69eff60399de65e0eced2e68

NetWire

d4288c3aa0a21e8b20e37255358a04546708892d1cba5a93707a3c3586c6eae5

NetWire

e482d2b16ccf9f71c4eab5a33796d1059aed7be13d48e356752498257c437c29

NetWire

eb082ead8de20d80f1aa722b1ea95512e7c08d26403b8cf8cd6670a7fbc75c95

NetWire

+ 901 additional samples on MalwareBazaar

Result

Malware family:

netwire

Score:

10/10

Tags:

family:netwire botnet rat stealer

Link:

https://tria.ge/reports/220819-kyv7rsdhf5/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Checks computer location settings

NetWire RAT payload

Netwire

Malware Config

C2 Extraction:

212.193.30.230:3363

Unpacked files

SH256 hash:

dc3dd747a662cc37d8b870533fd1a6b2460d48b802873a5b675f035f94e80258

MD5 hash:

5ceb26367644dc18aaf8429641880347

SHA1 hash:

bf9f14b89d94db64f2b593cbf4cd5fea35b49bf2

Detections:

win_netwire_g1

win_netwire_auto

Netwire

Link:

https://www.unpac.me/results/3dec534c-f696-4d42-87ac-eabc6ba1e83c/

Parent samples :

2abcdb606044f4db592baa3f9c808bf4fcab2146c49d83ba45a4ccbb20bc8354
d08f75542680080f9d3393fc3bb0ced3c30335db5030c1f38a8d7a7aadb15794
012622e521dee6e1c74c6796c92f1b5d31dda65f11e81c095340ca5ec22bdc3e
279f8bd4621f977e47756985c0cbf14e03c7f15c5200e83f03517a73649aa893
ff522148c553515ff4fcec77ffa6e2140c1c8faae3006133f5b82a0f1b8019dd
5e6ed3f0eda07ab20f0de1f4c2f9e355a558de4f53b1f81cadae2f3b2d4609a4

SH256 hash:

2fc3c162618426f95cffad9c6b63aa62ae6277af18e06ffc3a56f88d9289e45b

MD5 hash:

ac15b7b3043594998df0f1dfbfe7d664

SHA1 hash:

538df0ef29da541217e0abdebc584b1560159425

Detections:

win_netwire_g1

Netwire

Link:

https://www.unpac.me/results/3dec534c-f696-4d42-87ac-eabc6ba1e83c/

SH256 hash:

65f8d1d21c48130c1a903c4c81f0e063fa06859c5d9873f4ffc76af9bf4acf64

MD5 hash:

18d9b04ee2bfb82c428c8c0d3d172755

SHA1 hash:

e8ce35dddc1ae1a1f79cc3e767e5b3b043fa9031

Link:

https://www.unpac.me/results/3dec534c-f696-4d42-87ac-eabc6ba1e83c/

SH256 hash:

551ef0181260a5ab5728a618c2e86443753aaeb425e6c3b1346dfb0a661c73af

MD5 hash:

3c7205139e6aabd7de040b15021c24ed

SHA1 hash:

e4c66e4ca1bb3b5488d7c4ba7fddc8cac118955f

Link:

https://www.unpac.me/results/3dec534c-f696-4d42-87ac-eabc6ba1e83c/

SH256 hash:

9b4aee132a0228378d66a57fda3a2030952309ef74cf2db724ac916b04d8c034

MD5 hash:

93c6391d23c1aa1ed66fb13f82f2ee31

SHA1 hash:

220098c3047c32b51ae13a5cc1e9beeef3da6e18

Link:

https://www.unpac.me/results/3dec534c-f696-4d42-87ac-eabc6ba1e83c/

SH256 hash:

d08f75542680080f9d3393fc3bb0ced3c30335db5030c1f38a8d7a7aadb15794

MD5 hash:

c1ca174fbfc7936f8d9d0aad755f29cf

SHA1 hash:

16ad7f314c9c2742886523ac256fbb4a5f4bfdb0

Link:

https://www.unpac.me/results/3dec534c-f696-4d42-87ac-eabc6ba1e83c/

Malware family:

Netwire

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d08f75542680/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d08f75542680080f9d3393fc3bb0ced3c30335db5030c1f38a8d7a7aadb15794

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.