MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d15f99dbd30bae6e896c52a810fbcba080ae3ba76f3fc0d9a7761c5736ec7c81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 17


Intelligence 17 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d15f99dbd30bae6e896c52a810fbcba080ae3ba76f3fc0d9a7761c5736ec7c81
SHA3-384 hash: 391d03f15c76e2a4322805928a77faca4597ec8e74bcdbfbf3c7261beb42d176f6ca447c29cf3edd50cc236ce6677b0d
SHA1 hash: 9c5e87ce87b70a52f57097172c2babde2021454b
MD5 hash: 7a6a6b35d4bc575897a1420134afc96a
humanhash: steak-november-xray-rugby
File name:HEUR-Trojan.MSIL.Generic-d15f99dbd30bae6e896c.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:175'104 bytes
First seen:2023-06-25 21:35:14 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'013 x AgentTesla, 19'917 x Formbook, 12'332 x SnakeKeylogger)
ssdeep 3072:k/0CVy40hsbOeOyupBfOP8S6Uj9Av0fEdiFxFXwElgdEA/fLpujDqTrk3mjcqfZ:kswhwyJLjzfiib53W/fLpsDq/k7qf
Threatray 216 similar samples on MalwareBazaar
TLSH T1BB04124DC3DA901DCE28817B79F2472D9EB2DF1338838653B2DECA431B94660E943A1D
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:exe NetWire RAT


Avatar
abuse_ch
NetWire C2:
192.169.69.26:9002

Intelligence

File Origin
# of uploads :
1
# of downloads :
466
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
netwire
Create hunting rule
ID:
1
File name:
HEUR-Trojan.MSIL.Generic-d15f99dbd30bae6e896c.exe
Verdict:
Malicious activity
Analysis date:
2023-06-25 21:35:57 UTC
Tags:
netwire
Link:
https://app.any.run/tasks/7142473d-d629-444b-9040-fd11b7f466e1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
NetWire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/402721/
Detection(s):
Win.Trojan.Agent-6418378-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a process from a recently created file
Creating a file
Sending a custom TCP request
Launching a process
Creating a file in the Windows subdirectories
Enabling the 'hidden' option for recently created files
Unauthorized injection to a recently created process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Query of malicious DNS domain
Sending a TCP request to an infection source
Enabling autorun by creating a file
Unauthorized injection to a system process
Enabling autorun
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
lolbin obfuscated packed
Link:
https://www.filescan.io/uploads/6498b34276927ec2c007899b/reports/d0ee97e7-c855-4801-be47-cfb077633dfb/overview
Verdict:
Malicious
Labled as:
Bulz.Generic
Link:
https://www.hybrid-analysis.com/sample/d15f99dbd30bae6e896c52a810fbcba080ae3ba76f3fc0d9a7761c5736ec7c81
Malware family:
NetWire RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/922363ac-746f-4cd5-9d0a-f2d500175024
Result
Threat name:
Netwire
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1261148
Signature
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Creates an autostart registry key pointing to binary in C:\Windows
Drops PE files to the startup folder
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Uses dynamic DNS services
Writes to foreign memory regions
Yara detected Netwire RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 894168 Sample: HEUR-Trojan.MSIL.Generic-d1... Startdate: 25/06/2023 Architecture: WINDOWS Score: 100 35 sosclient.duckdns.org 2->35 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 Antivirus detection for dropped file 2->53 55 10 other signatures 2->55 8 HEUR-Trojan.MSIL.Generic-d15f99dbd30bae6e896c.exe 6 2->8         started        12 rundlll32.exe 3 2->12         started        14 rundlll32.exe 2 2->14         started        16 2 other processes 2->16 signatures3 process4 file5 31 C:\Users\user\AppData\...\rundlll32.exe, PE32 8->31 dropped 33 HEUR-Trojan.MSIL.G...30bae6e896c.exe.log, ASCII 8->33 dropped 57 Drops PE files to the startup folder 8->57 59 Hides that the sample has been downloaded from the Internet (zone.identifier) 8->59 18 rundlll32.exe 3 8->18         started        61 Writes to foreign memory regions 12->61 63 Allocates memory in foreign processes 12->63 65 Injects a PE file into a foreign processes 12->65 21 AppLaunch.exe 1 12->21         started        24 rundlll32.exe 2 12->24         started        signatures6 process7 dnsIp8 39 Writes to foreign memory regions 18->39 41 Allocates memory in foreign processes 18->41 43 Hides that the sample has been downloaded from the Internet (zone.identifier) 18->43 45 Injects a PE file into a foreign processes 18->45 26 rundlll32.exe 3 18->26         started        29 AppLaunch.exe 18->29         started        37 sosclient.duckdns.org 192.169.69.26, 49700, 49701, 49702 WOWUS United States 21->37 47 Creates an autostart registry key pointing to binary in C:\Windows 21->47 signatures9 process10 signatures11 67 Hides that the sample has been downloaded from the Internet (zone.identifier) 26->67
Detection:
netwire
Create hunting rule
Link:
https://mwdb.cert.pl/sample/d15f99dbd30bae6e896c52a810fbcba080ae3ba76f3fc0d9a7761c5736ec7c81/
Threat name:
ByteCode-MSIL.Trojan.Bulz
Create hunting rule
Status:
Malicious
First seen:
2021-09-11 10:44:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
25 of 37 (67.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2fpztw6tboxg5clmkkubb66lucak4o5hn474bwnhoyofonxmpsaq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
18e249edf52744fa58fd5b3f0f9c205ced077ac05bc7d9bb7e17a32edcb60a5c
NetWire
587e944c881d0e37982142ea1e15476b7bdcd6cdb7540a7b15899a5b196902d0
NetWire
5d74709b07b9681993c7827f352f1c8eb75d4067e6b65cb1aa83480e3b694944
NetWire
a0c1f8d3a65e0236068e42f67bccadf3af1f9e97b9d1ae1a4f4f6c98e9fd87af
NetWire
d25e23199a7c7f97e3e21ff927d53002353f22f299c41dca7cd3cdc3cae6531d
NetWire
d488a34718cf2db560dd4c62ccb5fac527cc192716c2d166a71f98abd384aba6
NetWire
d8d4a25dd484e96413ff9530e93621af5c53e96cf2b0435968f5fc72dad85d9b
NetWire
e74e35935d5ca8f98991689ed3524544e478a923a9212c87ec6c7c1bae67ec7c
NetWire
+ 206 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet persistence rat stealer
Link:
https://tria.ge/reports/230625-1fwnkseg52/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Drops startup file
Executes dropped EXE
Loads dropped DLL
Modifies Installed Components in the registry
NetWire RAT payload
Netwire
Malware Config
C2 Extraction:
sosclient.duckdns.org:9002
Unpacked files
SH256 hash:
817e54c2f3de9a4f613cda0e9acd185e78ed150105cf4abf7cec3b97ae1563a6
MD5 hash:
fdd75f9b58d4c73214f22b991fd04236
SHA1 hash:
8c2fb6e5f7c7519519116399bb81519358b4d5c6
Detections:
Netwire
Create hunting rule
win_netwire_auto
Create hunting rule
win_netwire_g1
Create hunting rule
Netwire
Create hunting rule
win_netwire_auto
Create hunting rule
win_netwire_g1
Create hunting rule
Netwire
Create hunting rule
win_netwire_auto
Create hunting rule
win_netwire_g1
Create hunting rule
Netwire
Create hunting rule
win_netwire_auto
Create hunting rule
win_netwire_g1
Create hunting rule
Link:
https://www.unpac.me/results/1ef2fc57-9b96-4e75-9a2b-7be9c6008be0/
SH256 hash:
325303abebc615ead9897f970e3d91b6d57b80d5539ef65c841b5278f54ca328
MD5 hash:
5b54903d5fb45c3be73d531248455f72
SHA1 hash:
862336a62f8ebd4088bf15a7c0f4daf17cb259e0
Link:
https://www.unpac.me/results/1ef2fc57-9b96-4e75-9a2b-7be9c6008be0/
SH256 hash:
817e54c2f3de9a4f613cda0e9acd185e78ed150105cf4abf7cec3b97ae1563a6
MD5 hash:
fdd75f9b58d4c73214f22b991fd04236
SHA1 hash:
8c2fb6e5f7c7519519116399bb81519358b4d5c6
Detections:
Netwire
Create hunting rule
win_netwire_auto
Create hunting rule
win_netwire_g1
Create hunting rule
Netwire
Create hunting rule
win_netwire_auto
Create hunting rule
win_netwire_g1
Create hunting rule
Netwire
Create hunting rule
win_netwire_auto
Create hunting rule
win_netwire_g1
Create hunting rule
Netwire
Create hunting rule
win_netwire_auto
Create hunting rule
win_netwire_g1
Create hunting rule
Link:
https://www.unpac.me/results/1ef2fc57-9b96-4e75-9a2b-7be9c6008be0/
SH256 hash:
325303abebc615ead9897f970e3d91b6d57b80d5539ef65c841b5278f54ca328
MD5 hash:
5b54903d5fb45c3be73d531248455f72
SHA1 hash:
862336a62f8ebd4088bf15a7c0f4daf17cb259e0
Link:
https://www.unpac.me/results/1ef2fc57-9b96-4e75-9a2b-7be9c6008be0/
SH256 hash:
d15f99dbd30bae6e896c52a810fbcba080ae3ba76f3fc0d9a7761c5736ec7c81
MD5 hash:
7a6a6b35d4bc575897a1420134afc96a
SHA1 hash:
9c5e87ce87b70a52f57097172c2babde2021454b
Link:
https://www.unpac.me/results/1ef2fc57-9b96-4e75-9a2b-7be9c6008be0/
Malware family:
Netwire
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d15f99dbd30b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d15f99dbd30bae6e896c52a810fbcba080ae3ba76f3fc0d9a7761c5736ec7c81

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:Malicious_BAT_Strings
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a string also used in Netwire RAT auxilliary
Reference:https://pastebin.com/8qaiyPxs
Rule name:malware_netwire_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect netwire in memory
Reference:internal research
Rule name:MAL_unspecified_Jan18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects unspecified malware sample
Reference:Internal Research
Rule name:MAL_unspecified_Jan18_1_RID2F4A
Create hunting rule
Author:Florian Roth
Description:Detects unspecified malware sample
Reference:Internal Research
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:netwire
Create hunting rule
Author:jeFF0Falltrades
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Suspicious_BAT_Strings
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects a string also used in Netwire RAT auxilliary
Reference:https://pastebin.com/8qaiyPxs
Rule name:Windows_Trojan_Netwire_6a7df287
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Netwire_f42cb379
Create hunting rule
Author:Elastic Security
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.netwire.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/402721/

Comments