MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f5c3a4c6e9a672d984b794977cac7cc5ce38b6ab3c76bb79227217cc432a6ad9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NetWire

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	f5c3a4c6e9a672d984b794977cac7cc5ce38b6ab3c76bb79227217cc432a6ad9
SHA3-384 hash:	940fe75f3e26293e17696050f376cdacb3460177aea65fa59b9edd401b12c5f79b9e49748aef98817e90416581061e72
SHA1 hash:	0c38c79c96dc9b0b8d66a49f5f9090adf00ed08a
MD5 hash:	207dc7e7b1671e1b60003eb4e55b6859
humanhash:	pizza-happy-india-fruit
File name:	P O U9827_PDF.exe
Download:	download sample
Signature	NetWire Create hunting rule
File size:	872'448 bytes
First seen:	2020-10-22 07:08:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ccd488364d7b78bdf79a98e8e2961731 (6 x Loki, 1 x NetWire, 1 x AveMariaRAT)
ssdeep	12288:Ya33sOGI1IyzoGHUnk3OhzqNU6m31LTaD9vizx47EsS3KRd4o3kAL13aW:9MHI1cGEkeh2q6MsizOd+u4HQz
Threatray	274 similar samples on MalwareBazaar
TLSH	FE059E62E2F15CF7C12316389D0B57A4A827BE503D3879862BF56C3C5F39681782A2D7
Reporter	abuse_ch
Tags:	exe NetWire RAT

abuse_ch

Malspam distributing NetWire:

HELO: smg5.telkomsa.net
Sending IP: 105.187.200.242
From: raaj@telkomsa.net
Subject: RE: Quote
Attachment: QUOTE9036.IMG (contains "P O U9827_PDF.exe")

NetWire RAT C2:
23.105.131.243:3363

Intelligence

File Origin

# of uploads :

# of downloads :

151

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Netwire

Link:

https://www.capesandbox.com/analysis/74516/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Unauthorized injection to a recently created process

Launching a process

Sending a custom TCP request

Unauthorized injection to a system process

Enabling autorun by creating a file

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f5c3a4c6e9a672d984b794977cac7cc5ce38b6ab3c76bb79227217cc432a6ad9/

Threat name:

Win32.Trojan.LokibotCrypt

Status:

Malicious

First seen:

2020-10-22 05:41:27 UTC

AV detection:

26 of 28 (92.86%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6xb2jrxjuzzntbfxsslxzld4yxhdrnvlhr3lw6jcoil4yqzknlmq._file

Verdict:

malicious

Label(s):

netwirerc

Result

Malware family:

netwire

Score:

10/10

Tags:

rat botnet stealer family:netwire

Link:

https://tria.ge/reports/201022-j2qgjb56e2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Drops startup file

NetWire RAT payload

Netwire

Unpacked files

SH256 hash:

f5c3a4c6e9a672d984b794977cac7cc5ce38b6ab3c76bb79227217cc432a6ad9

MD5 hash:

207dc7e7b1671e1b60003eb4e55b6859

SHA1 hash:

0c38c79c96dc9b0b8d66a49f5f9090adf00ed08a

Link:

https://www.unpac.me/results/a1d3c673-21a7-49ac-be4e-c9853d2e12a2/

SH256 hash:

8457b7569fc51a94db95fbeef895c2890326458fc2aa9e77327edb0764b98b8e

MD5 hash:

4789c74c08e1a7d46d1a67b56f072a65

SHA1 hash:

7892e32d0c78b9eb61fdb622973346a73a5939e6

Detections:

win_netwire_g1

win_netwire_auto

Link:

https://www.unpac.me/results/a1d3c673-21a7-49ac-be4e-c9853d2e12a2/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	IPPort_combo_mem Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	win_netwire_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator