MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee105aefe05012972398fb6eed4c5b408b1c7c81072a5b97e99cd4072c4f853f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 12

Intelligence 12 IOCs YARA 3 File information Comments

SHA256 hash:	ee105aefe05012972398fb6eed4c5b408b1c7c81072a5b97e99cd4072c4f853f
SHA3-384 hash:	00483721cddac45f4b5f42ed76aa411e223cebec5bfe217eaf32e28ee07b26b22a0e0e8a6617f771132206e42a009e30
SHA1 hash:	6864be8eb5e73083b5efba5105a75d93c8966b3a
MD5 hash:	041949a1bd465384fa674b1a6d390177
humanhash:	low-mountain-minnesota-magazine
File name:	SCAN_QUO.EXE
Download:	download sample
Signature	NetWire Create hunting rule
File size:	237'913 bytes
First seen:	2021-03-17 06:35:05 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	b1a57b635b23ffd553b3fd1e0960b2bd (39 x Formbook, 29 x Loki, 27 x AgentTesla)
ssdeep	6144:rhjmmejORX37kOr+XaPZAZMj6A1CVVUpjEduX1Lb48dfXuOT1:/ejgwfqKMj6AqipjEd2ts8dfFx
Threatray	405 similar samples on MalwareBazaar
TLSH	75340122A5808473F9BB5BB621369A98F7B58DCA2DF14D0F8B443BA637F21C3441651F
Reporter	cocaman
Tags:	exe NetWire

Intelligence

File Origin

# of uploads :

# of downloads :

402

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SCAN_QUO.EXE

Verdict:

Malicious activity

Analysis date:

2021-03-17 06:35:46 UTC

Tags:

rat netwire trojan

Link:

https://app.any.run/tasks/2dca3740-dff3-49f5-8c16-9cee9797b621

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Netwire

Link:

https://www.capesandbox.com/analysis/124485/

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.1970.22539.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Creating a file

Unauthorized injection to a recently created process

DNS request

Creating a window

Sending a custom TCP request

Sending a UDP request

Result

Verdict:

SUSPICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

NetWire RAT

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/96ba9d50-d4cf-4011-9975-44b4f85ab281

Result

Threat name:

NetWire

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/641698

Signature

Contains functionality to log keystrokes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Internet Explorer form passwords

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NetWire

Uses dynamic DNS services

Yara detected NetWire RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ee105aefe05012972398fb6eed4c5b408b1c7c81072a5b97e99cd4072c4f853f/

Threat name:

Win32.Trojan.Wacatac

Status:

Malicious

First seen:

2021-03-17 00:35:30 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

12 of 28 (42.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=5yifv37akajjoi4y7nxo2tc3icfry7eba4vfxf7jttkaolcpqu7q._file

Verdict:

malicious

Label(s):

netwirerc

Result

Malware family:

netwire

Score:

10/10

Tags:

family:netwire botnet rat stealer

Link:

https://tria.ge/reports/210317-agsf655hyj/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Loads dropped DLL

NetWire RAT payload

Netwire

Unpacked files

SH256 hash:

abf492eda75e6a4e7382ec3a201d8072870768dc0d5c0db9ed249ff7936e9e8a

MD5 hash:

793d2136d62ab829cef4d5d601dfa1a2

SHA1 hash:

f575fcea68dd8e0a5c7d87b5e082a7e429b2e471

Link:

https://www.unpac.me/results/9591b2a8-29ea-42e2-ab4b-eba901174b63/

SH256 hash:

8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

MD5 hash:

d753362649aecd60ff434adf171a4e7f

SHA1 hash:

3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

Link:

https://www.unpac.me/results/9591b2a8-29ea-42e2-ab4b-eba901174b63/

SH256 hash:

ee105aefe05012972398fb6eed4c5b408b1c7c81072a5b97e99cd4072c4f853f

MD5 hash:

041949a1bd465384fa674b1a6d390177

SHA1 hash:

6864be8eb5e73083b5efba5105a75d93c8966b3a

Link:

https://www.unpac.me/results/9591b2a8-29ea-42e2-ab4b-eba901174b63/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Eldorado

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/ee105aefe05012972398fb6eed4c5b408b1c7c81072a5b97e99cd4072c4f853f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	MALWARE_Win_NetWire Create hunting rule
Author:	ditekSHen
Description:	Detects NetWire RAT

Rule name:	win_netwire_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator