MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e89f7cbe30c473af31238429762b1d46ed174fefa8bf559198766fb1658905fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e89f7cbe30c473af31238429762b1d46ed174fefa8bf559198766fb1658905fd
SHA3-384 hash: 45307fa6a75cc725c2003231eba855271b5d4957f35ad42e76bee1dbf0e27f2bff5b0cfd62ee73b5f1ebc92cdc340463
SHA1 hash: 0b5736f16ff3a1c6ae1b7da66ea133f78c0edb64
MD5 hash: 4bcaa1fd3e3d01cddb9e635b2bc7fe84
humanhash: nitrogen-river-michigan-ceiling
File name:infodayclubhai.com__kin.exe
Download: download sample
Signature NetWire
Create hunting rule
File size:663'552 bytes
First seen:2020-03-18 18:12:30 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash eb259d462f962d811cf47a86f74c1585 (1 x NetWire)
ssdeep 12288:Mfk9EwewZtQdbNGHGdHUBCMtzLmuzCs17/YZvgskjNpWZa8uhhhhhhhhhhhhhhh5:PTznmdHcCMtzLmuzCs17/YZvgskjNpW4
Threatray 4'674 similar samples on MalwareBazaar
TLSH 8CE48D6114DB9B3FEE5B8973311985BDD270FE53AA8CB9742AC4739623BE3665C04302
Reporter ov3rflow1
Tags:exe NetWire

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Fareit-6782143-0
Create hunting rule

Win.Trojan.Gamarue-7088569-0
Create hunting rule

Win.Trojan.Fareit-7101834-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2018-04-11 00:28:32 UTC
File Type:
PE (Exe)
Extracted files:
10
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
1b5be721b01afba707b56c346bc64a246cfd8b0cf06ce89ea290cfd748f1b577
NetWire
20e5edeac32212fe8dcc9e5ab6f872d7e647e5e78eb707f2e0704817e3c092e0
NetWire
2ea74bf397854358ce0363ce3176f0c0dc40ac0efb6f378422e2d72c8c078372
NetWire
2ff76dce8a2f9ea8d6904b9705447ff3fb45e77fa32a3f2c446f318b4aee2148
NetWire
38bb0a1d49eb96f7fae4e2e6831184522114744b354fd2b299eafc3d76bc7a62
NetWire
8d703de189a2ba36e099a2276e2ba596d40c54c21eec779286667e8dd6c2e5b8
NetWire
99737bd60422defc150edf7e1ec863acd6d2e599e8139aa987b6b4c43ab18cec
NetWire
9f10a3e22fd6722a29b863e9ab03a41234d3339414331bb074226dcc3195d610
NetWire
d0c571182eb67023db9b2f8c440dfc76488b23ea51819de40bbeca16fbb9322e
NetWire
e3212a19bbf13d1e8c9d6c80be5dedd5ce5d13acfd276d8a1c29370d500196bd
NetWire
+ 4'664 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e89f7cbe30c473af31238429762b1d46ed174fefa8bf559198766fb1658905fd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/4297/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
VB_APILegacy Visual Basic API usedMSVBVM60.DLL::__vbaSetSystemError
MSVBVM60.DLL::EVENT_SINK_AddRef
MSVBVM60.DLL::__vbaErrorOverflow

Comments