MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5a60b271318f87d0c04e707b465dcac2b45deca18094eb0088b880080900e4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5a60b271318f87d0c04e707b465dcac2b45deca18094eb0088b880080900e4e
SHA3-384 hash: 92c1c247c583dd3a062baf5294ccac989181909e2ec8bcde514c9d1e67f2f4d1a9711f247321800c9957592ca2857880
SHA1 hash: 51c1cf6eb9974bdee2b5e5de23c1f24557625b23
MD5 hash: a1e3bc029cfb7e72f553833057e242f5
humanhash: speaker-floor-muppet-hawaii
File name:Entity ID.rar
Download: download sample
Signature NetWire
Create hunting rule
File size:125'173 bytes
First seen:2021-10-05 05:06:20 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:5+egL8pwBkFGYRHLYgM0AE0kAELO/dsKlgcCiSPdCCsywlR2j0s+c:5wBIGY9LYgCEdAEUgcmbM2Qs+c
TLSH T13CC312775AE2E381D6EB2C384B19CB03CABBD07CA42D9857CA5C0FC7A5E04AC525D136
Reporter fabjer
Tags:NetWire rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
410
Origin country :
n/a
Vendor Threat Intelligence
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-vm evasive greyware keylogger obfuscated packed packed
Link:
https://www.filescan.io/uploads/615c061be3d213d202b76dd5/reports/6fe519af-47b6-45fe-a11a-5f249dbe32d5/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5a60b271318f87d0c04e707b465dcac2b45deca18094eb0088b880080900e4e/
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2021-10-04 23:17:42 UTC
AV detection:
18 of 45 (40.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2wtawjytdd4h2dae44d3izo4vqvulxwkdaeu5mairoeabaeqbzha._file
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet persistence rat stealer
Link:
https://tria.ge/reports/211005-fr1fpahebm/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Adds Run key to start application
NetWire RAT payload
Netwire
Malware Config
C2 Extraction:
info1.dynamic-dns.net:3360
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d5a60b271318f87d0c04e707b465dcac2b45deca18094eb0088b880080900e4e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

rar d5a60b271318f87d0c04e707b465dcac2b45deca18094eb0088b880080900e4e

(this sample)

NetWire

Executable exe 9a6c78c463ea3f40ea7ae0532453f2a1c895f848b7b6dd0f3d40c723c67615e9

  
Dropping
SHA256 9a6c78c463ea3f40ea7ae0532453f2a1c895f848b7b6dd0f3d40c723c67615e9
  
Delivery method
Distributed via e-mail attachment

Comments