MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db5dc86af801e2c47013fc8aa7d23d10fee192e8a6020121ddb542a4a3555b55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 10


Intelligence 10 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db5dc86af801e2c47013fc8aa7d23d10fee192e8a6020121ddb542a4a3555b55
SHA3-384 hash: ae2f407f0fc2c57123fb58e6f0149a912e4245107de1ff878ef1d9b05c2aeb045d1323875f96d6dcb3b5342189edd232
SHA1 hash: abbb1eccf7f03e011192ddec58d3df70b51931b5
MD5 hash: 41f98d26c5379bc7cbbb0c3658a66dfa
humanhash: xray-fourteen-triple-lamp
File name:INV00392.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:768'000 bytes
First seen:2020-07-17 06:26:47 UTC
Last seen:2020-07-17 09:37:41 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'658 x AgentTesla, 19'469 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:QrMnqjzGYIdjMxMSo15GXacXYp3uyAjrMnnmz5HWuSLQB5jX9fVuRZ2k4zUOY:QrvxguwcLjrTT6QB5jX6Re
Threatray 450 similar samples on MalwareBazaar
TLSH 3CF418F79B4D82C2C49F9EBCC4820B710997ED85F0F5A60B03667C3636767A0E88556B
Reporter JAMESWT_WT
Tags:NetWire

Intelligence

File Origin
# of uploads :
3
# of downloads :
236
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Netwire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/27231/
Detection(s):
SecuriteInfo.com.Trojan.Siggen9.59975.8118.30503.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Connection attempt to an infection source
Enabling autorun with Startup directory
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/388968
Signature
Contains functionality to steal Chrome passwords or cookies
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NetWire
Sigma detected: Scheduled temp file as task from temp location
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
netwire
Create hunting rule
Link:
https://mwdb.cert.pl/sample/db5dc86af801e2c47013fc8aa7d23d10fee192e8a6020121ddb542a4a3555b55/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-17 06:28:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3no4q2xyahrmi4at7sfkpur5cd7odexiuybacio5wvbkji2vlnkq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
1296e2be1e9e8dc2431cd3c37337af6fe9f2ad6e9b380111507b009642250216
NetWire
21cef6da04f726523131dbde12855b6d1d6d65cc9b0075d05b90b7636b56c8da
NetWire
8cafd9b602e666abf81ea94c48663a8a1ebbf06746ed799be5184ecb748ae304
NetWire
9a6951c6f3c33c217edd9a4e32f5422c4e125b909d0c88e190b76eb695f05b72
NetWire
9de5e8e2d7733dfcf568e5b11a95d2468ef905e90169d7a4c93e1909a0372f04
NetWire
e6db6d5f9019bdefffc749264a267c1927dcf5eba5a7ea3dfb10db457b6b2a16
NetWire
eaf820c89e009bafc8d9b577392f83a203e37ffc8b0a3e9281e313a705836e28
NetWire
ece26faace5bcf7afeba359279d17aeb7f99f739fce454e964c88ebad9745bdb
NetWire
f24e45d41404cdbd5b3e88ef39f6b047d062ade5cb3bddbe2ad40d5331e27210
NetWire
fc70d13e41ab6c3d36b72e329549c48e70767e37b06c5bbe7284896e935c6815
NetWire
+ 440 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
rat botnet stealer family:netwire
Link:
https://tria.ge/reports/200717-85ke2vwg12/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
NetWire RAT payload
Netwire
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/db5dc86af801e2c47013fc8aa7d23d10fee192e8a6020121ddb542a4a3555b55

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NetWire

Executable exe db5dc86af801e2c47013fc8aa7d23d10fee192e8a6020121ddb542a4a3555b55

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/27231/
  
URLhaus
https://urlhaus.abuse.ch/url/413866/
  
Delivery method
Distributed via web download

Comments