MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2535caecce2737920213eb3f84ad8f9cb783d4562303bfad9bcdbb7749d1c01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2535caecce2737920213eb3f84ad8f9cb783d4562303bfad9bcdbb7749d1c01
SHA3-384 hash: 00afa58c3ccd0ae88c8502781efbe224deb5cd64e45705f06a9b3e4615c9d078dd0de03ecea2795674d80cf795ebd736
SHA1 hash: 0404f0ab965003df49340907c9356f152f09bc6a
MD5 hash: cbf88b72ada5752fa8f6927db5d62cfe
humanhash: lemon-carbon-hamper-yellow
File name:f2535caecce2737920213eb3f84ad8f9cb783d4562303bfad9bcdbb7749d1c01
Download: download sample
Signature NanoCore
Create hunting rule
File size:754'176 bytes
First seen:2020-06-10 12:27:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'599 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:qLWnBHwxYlyFEfA/LRotZHM1z8iGigKV/eB8oWGQH8hu5BcyE2:HnBHw8eb1z
Threatray 1'381 similar samples on MalwareBazaar
TLSH 77F480F7ED8C4E1CCE915FF8622D99C16116BAB1CDE0A28E578021758D2B674C871ECB
Reporter JAMESWT_WT
Tags:NanoCore

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 13:22:46 UTC
File Type:
PE (.Net Exe)
Extracted files:
15
AV detection:
23 of 31 (74.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6jjvzlwm4jzxsibbh2z7qswy7hfxqpkfmiydx6wzxtn3o5e5dqaq._file
Verdict:
malicious
Label(s):
netwirerc
Create hunting rule
Similar samples:
448379f1a0a59fa0a84180351e48559c9ed7ea6875cdd525782b714a77a2fff9
NanoCore
73cc33d200ce22012733ea7c3fa8d03ef3ea65164497314d7d05b2992892d4e0
NanoCore
84783d501b78575f30aa33097f9c7c885542b892512403424fc069b048189e98
NanoCore
90bb157f9c5241f567eb56be38e3ba9f51a0ec5a8da3c77fdb1bed1f2095c39b
NanoCore
99b13841abbf0c2bf736ab08e0e7f48cd28cab2e69eff60399de65e0eced2e68
NanoCore
af3c8597b7f874293c5b1fe53c4d1c476c7fdf06df678ba31d75c8f126ae90a0
NanoCore
d3793a581da66ef5840648574ce364846e7c68a559c0f5e49faf9e4892ecdc72
NanoCore
e13913aa4153b0a0fcc5951f9b9502496471ef63cb98b110da3b15dddac64600
NanoCore
eb082ead8de20d80f1aa722b1ea95512e7c08d26403b8cf8cd6670a7fbc75c95
NanoCore
eff29f6e669e851b8449f4e7dcf2e0ba010e08b3a929c872ee51569b331e67eb
NanoCore
+ 1'371 additional samples on MalwareBazaar
Result
Malware family:
netwire
Create hunting rule
Score:
  10/10
Tags:
family:netwire botnet rat stealer
Link:
https://tria.ge/reports/201109-hpzk7cf1r6/
Behaviour
NTFS ADS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
NetWire RAT payload
Netwire
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Malicious_BAT_Strings
Create hunting rule
Author:Florian Roth
Description:Detects a string also used in Netwire RAT auxilliary
Reference:https://pastebin.com/8qaiyPxs
Rule name:MAL_unspecified_Jan18_1
Create hunting rule
Author:Florian Roth
Description:Detects unspecified malware sample
Reference:Internal Research
Rule name:netwire
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect netwire in memory
Reference:internal research
Rule name:Suspicious_BAT_Strings
Create hunting rule
Author:Florian Roth
Description:Detects a string also used in Netwire RAT auxilliary
Reference:https://pastebin.com/8qaiyPxs
Rule name:win_netwire_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments