MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef9e50bbc71c2f7c213f49e413cebab25733d52f82f2197ab256471ecb3db3bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 11

Intelligence 11 IOCs YARA 8 File information Comments

SHA256 hash:	ef9e50bbc71c2f7c213f49e413cebab25733d52f82f2197ab256471ecb3db3bf
SHA3-384 hash:	9383767ec52a8b4ea2743b2e14b97e0f8f92780f6ea027ed0e909421ab1405ac60cd82a2c08628df3e68234d857850e7
SHA1 hash:	c84d8e6cd5218bdc77b5511a7b38cd94c02fa463
MD5 hash:	630c736f4a8124225065b21a153b889d
humanhash:	batman-iowa-mississippi-five
File name:	Proof of Payment.exe
Download:	download sample
Signature	NetWire Create hunting rule
File size:	1'476'608 bytes
First seen:	2021-01-19 07:35:59 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'663 x AgentTesla, 19'478 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	24576:1K+VTxMRa62knGKwQu4wAKg3uW7hGX8nhpklhumF:QyMwPknPwlQ3u0hG+klH
Threatray	344 similar samples on MalwareBazaar
TLSH	6D65D6AC722071EFC857D4B29AA81DA8EA547C7B431B4503E46736ADDA3C897CF144F2
Reporter	abuse_ch
Tags:	exe NetWire RAT

abuse_ch

Malspam distributing NetWire:

HELO: mail.getemails.website
Sending IP: 5.189.220.185
From: Nedbank <Notification@nedbank.co.za>
Reply-To: No-reply@nedbank.co.za
Subject: Payment Notification
Attachment: Proof of Payment.img (contains "Proof of Payment.exe")

Intelligence

File Origin

# of uploads :

# of downloads :

324

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Proof of Payment.exe

Verdict:

Malicious activity

Analysis date:

2021-01-19 08:18:14 UTC

Tags:

rat netwire trojan

Link:

https://app.any.run/tasks/2d20e290-656d-47f8-bf2f-cf26ea4f9114

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/112804/

Detection(s):

Win.Packed.Genkryptik-9822492-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a UDP request

Creating a window

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Unauthorized injection to a recently created process

Creating a file

Sending a TCP request to an infection source

Enabling autorun by creating a file

Result

Threat name:

NetWire

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/584663

Signature

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to steal Chrome passwords or cookies

Detected unpacking (changes PE section rights)

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

PE file has nameless sections

Sigma detected: NetWire

Sigma detected: Scheduled temp file as task from temp location

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected AntiVM_3

Yara detected NetWire RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

netwire

Link:

https://mwdb.cert.pl/sample/ef9e50bbc71c2f7c213f49e413cebab25733d52f82f2197ab256471ecb3db3bf/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-01-19 07:36:13 UTC

AV detection:

17 of 46 (36.96%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=56pfbo6hdqxxyij7jhsbhtv2wjlthvjpqlzbs6vskzdr5sz5wo7q._file

Verdict:

malicious

Label(s):

netwirerc

Result

Malware family:

netwire

Score:

10/10

Tags:

family:netwire botnet rat stealer

Link:

https://tria.ge/reports/210119-zcpa6b1l82/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

NetWire RAT payload

Netwire

Unpacked files

SH256 hash:

a4fe7191b7d100a2fbd32aac439154e528607f73ed29fd56825d7048ffbccaf3

MD5 hash:

8a8c5b219962d6329a543a392eb50d6b

SHA1 hash:

a084ab4b28a6c2a7a8b9f6e84202abd1122aca81

Detections:

win_netwire_g1

win_netwire_auto

Link:

https://www.unpac.me/results/ace39226-293d-4191-91a2-756cf505679a/

Parent samples :

41dbe67f8521046283d43077e26d6fef8a830e94f6ad1b1765dc5056f8d81846
2dc1258101b1183ad4e08320f15310cad541c900919e98e0816c751fee303306
ef9e50bbc71c2f7c213f49e413cebab25733d52f82f2197ab256471ecb3db3bf
842a7bdd501965dc3ce327604d73374aa1c392ce2a151fc55561e42782ea30f2

SH256 hash:

246dd44b5fb4d1816b7aa2d4deadf1661593006d14b81aa92e967a759024452e

MD5 hash:

534aae230effa7495f0b06ed64ab186e

SHA1 hash:

8ffeb1e1d5e8a836bd085cd79a1ab6982d30b859

Link:

https://www.unpac.me/results/ace39226-293d-4191-91a2-756cf505679a/

SH256 hash:

64a419709ad219ffc006bda776b650da486d55048d2fa34525f40227da0e5c86

MD5 hash:

88c0ec8398978fa2e4240f02765086ad

SHA1 hash:

5a5c4935b2d70e890c89ad9332365f4f4aa86f3c

Link:

https://www.unpac.me/results/ace39226-293d-4191-91a2-756cf505679a/

SH256 hash:

ef9e50bbc71c2f7c213f49e413cebab25733d52f82f2197ab256471ecb3db3bf

MD5 hash:

630c736f4a8124225065b21a153b889d

SHA1 hash:

c84d8e6cd5218bdc77b5511a7b38cd94c02fa463

Link:

https://www.unpac.me/results/ace39226-293d-4191-91a2-756cf505679a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ef9e50bbc71c2f7c213f49e413cebab25733d52f82f2197ab256471ecb3db3bf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	IPPort_combo_mem Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	Malicious_BAT_Strings Create hunting rule
Author:	Florian Roth
Description:	Detects a string also used in Netwire RAT auxilliary
Reference:	https://pastebin.com/8qaiyPxs

Rule name:	MAL_unspecified_Jan18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects unspecified malware sample
Reference:	Internal Research

Rule name:	netwire Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect netwire in memory
Reference:	internal research

Rule name:	Ping_Del_method_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	cmd ping IP nul del

Rule name:	Suspicious_BAT_Strings Create hunting rule
Author:	Florian Roth
Description:	Detects a string also used in Netwire RAT auxilliary
Reference:	https://pastebin.com/8qaiyPxs

Rule name:	win_netwire_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator