MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e83b81147f0b08a09751772c75cdec2522f2fce19b1f035a2ddc415f633dd2e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 13


Intelligence 13 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e83b81147f0b08a09751772c75cdec2522f2fce19b1f035a2ddc415f633dd2e0
SHA3-384 hash: 727ba5e76cca794c59471c05f1c6bd22f168e3e6e38ba3dfbdfd3c2820bc61fc6006b13510e2018665ca79af2c1e5570
SHA1 hash: 579087fc5e71649bd6d6571dce64fa3274de9e75
MD5 hash: 1c87b7bb26836a82f5597f96598829c8
humanhash: nevada-vermont-bacon-march
File name:5976230.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:350'854 bytes
First seen:2022-02-18 14:18:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 099c0646ea7282d232219f8807883be0 (476 x Formbook, 210 x Loki, 107 x AgentTesla)
ssdeep 6144:GwkeKSQbg+8LberIvOk5vZWIsPpyNuiJTfnCSFjKQ:AzUpkByNjYSF+Q
Threatray 40 similar samples on MalwareBazaar
TLSH T14C74018725F454AEE12E0FF334FB8A595ABB8E10297D9603FB327D66B2322C150153E5
File icon (PE):PE icon
dhash icon 4c33d8d4d4d8334c (2 x NetWire, 2 x AgentTesla, 2 x SnakeKeylogger)
Reporter James_inthe_box
Tags:exe NetWire

Intelligence

File Origin
# of uploads :
1
# of downloads :
435
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NetWire
Create hunting rule
Link:
https://www.capesandbox.com/analysis/242546/
Detection(s):
SecuriteInfo.com.FakeAV.CXA.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a window
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Sending a custom TCP request
Launching the default Windows debugger (dwwin.exe)
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process
Unauthorized injection to a recently created process by context flags manipulation
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll
Link:
https://www.filescan.io/uploads/620faaa2875593a3cce57f13/reports/4b42b017-aac0-4a83-a3ac-668c9b8ab7e3/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
NetWire RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1845f386-2af9-4933-b48b-e78b7d235508
Result
Threat name:
NetWire
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/942256
Signature
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Contains functionality to log keystrokes
Contains functionality to steal Chrome passwords or cookies
Contains functionality to steal Internet Explorer form passwords
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 574734 Sample: 5976230.exe Startdate: 18/02/2022 Architecture: WINDOWS Score: 100 56 Found malware configuration 2->56 58 Malicious sample detected (through community Yara rule) 2->58 60 Antivirus detection for URL or domain 2->60 62 4 other signatures 2->62 9 5976230.exe 19 2->9         started        12 iybybvq.exe 1 2->12         started        14 iybybvq.exe 1 2->14         started        process3 file4 42 C:\Users\user\AppData\Local\Temp\favlo.exe, PE32 9->42 dropped 16 favlo.exe 1 3 9->16         started        20 WerFault.exe 3 10 12->20         started        23 conhost.exe 12->23         started        25 WerFault.exe 10 14->25         started        27 conhost.exe 14->27         started        process5 dnsIp6 40 C:\Users\user\AppData\Roaming\...\iybybvq.exe, PE32 16->40 dropped 48 Contains functionality to log keystrokes 16->48 50 Found evasive API chain (may stop execution after checking mutex) 16->50 52 Contains functionality to steal Internet Explorer form passwords 16->52 54 Contains functionality to steal Chrome passwords or cookies 16->54 29 favlo.exe 3 16->29         started        32 conhost.exe 16->32         started        46 192.168.2.1 unknown unknown 20->46 file7 signatures8 process9 file10 44 C:\Users\user\AppData\Roaming\...\Host.exe, PE32 29->44 dropped 34 Host.exe 1 29->34         started        process11 process12 36 WerFault.exe 22 9 34->36         started        38 conhost.exe 34->38         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e83b81147f0b08a09751772c75cdec2522f2fce19b1f035a2ddc415f633dd2e0/
Threat name:
Win32.Trojan.NetWired
Create hunting rule
Status:
Malicious
First seen:
2022-02-18 07:26:16 UTC
File Type:
PE (Exe)
Extracted files:
4
AV detection:
21 of 42 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5a5ycfd7bmekbf2ro4whltpmeurpf7hbtmpqgwrn3rav6yz52lqa._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
03dcc84a1b2387ef18e82b9deeaa45da311890d27b3d28d022d43924201b7bcc
NetWire
060231c7729f65f39c1cc05fbe097d9c872dabd9391cc20eaf60c8d3c3cb0b5a
NetWire
1d54082d540ab23f276aafeb6bad1b8c7b0c435fc539dcda3be3f6423da0d8f4
NetWire
3cc9ec44e7516c0db0a27794c540fcc5a0c6d322821debaee8bd4d0a1231b4df
NetWire
5054502ff8808d917e36e5d73145caa3e181f97f98ce50bb0dc30ddfe657ce0b
NetWire
6901142f041abcfc97b29e0c77e99fb531e1ee2ea4e5287b0ec1105f8a58a68c
NetWire
e4715658b6981b37c06e063e6b59af6d82c8c5edeb93e339e367d497332b7b69
NetWire
e748f3e105a9370ec194134350c352b1a2c12cdf43be16e5804e4eb12ab39c13
NetWire
+ 30 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet persistence rat stealer
Link:
https://tria.ge/reports/220218-rl9yqacfa5/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
NetWire RAT payload
Netwire
Suspicious use of NtCreateProcessExOtherParentProcess
Malware Config
C2 Extraction:
194.147.140.14:3360
Unpacked files
SH256 hash:
b6116ab2f5d8d9be2ae327f3bfbbae58e7aac59d7ad284a8d92708ab391338c0
MD5 hash:
f35d90a9a4d87916bee33c42f6dd8d0d
SHA1 hash:
f68f633d3e65b3176c6e5d7ac14f191cea60c8cb
Detections:
win_netwire_g1
Create hunting rule
Link:
https://www.unpac.me/results/9abc0f5d-b519-4d5d-8e0b-e0cce17bd975/
Parent samples :
e4715658b6981b37c06e063e6b59af6d82c8c5edeb93e339e367d497332b7b69
e83b81147f0b08a09751772c75cdec2522f2fce19b1f035a2ddc415f633dd2e0
SH256 hash:
c307fdb13cb72f77030a3be86c2b05ec2fe43517d36c64e2b8f5bb31e8945309
MD5 hash:
7a7c6650c1ad93bdffa90de794d55122
SHA1 hash:
9381ad010f0f7a01db4ee3a50cfd795be46e9a4e
Link:
https://www.unpac.me/results/9abc0f5d-b519-4d5d-8e0b-e0cce17bd975/
SH256 hash:
e83b81147f0b08a09751772c75cdec2522f2fce19b1f035a2ddc415f633dd2e0
MD5 hash:
1c87b7bb26836a82f5597f96598829c8
SHA1 hash:
579087fc5e71649bd6d6571dce64fa3274de9e75
Link:
https://www.unpac.me/results/9abc0f5d-b519-4d5d-8e0b-e0cce17bd975/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.83
Link:
https://yomi.yoroi.company/submissions/e83b81147f0b08a09751772c75cdec2522f2fce19b1f035a2ddc415f633dd2e0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/242546/

Comments