MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ff32e93cbeacbeda2437159fc90e1c0a4b6b1d7fa160a931fe80801ba6e3311d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
NetWire
Vendor detections: 11
| SHA256 hash: | ff32e93cbeacbeda2437159fc90e1c0a4b6b1d7fa160a931fe80801ba6e3311d |
|---|---|
| SHA3-384 hash: | 9396d6bf7512a5f6ac5ed5216f3d38d8be640a7ae44236799c17cd745b59c40beffffdf4ba174447ea059c4910eff032 |
| SHA1 hash: | e0e21df731ac7e2bcaa1fa1ca0a3f12936a111a4 |
| MD5 hash: | 39354b7b1d0dda28b95785b967621c07 |
| humanhash: | jupiter-fix-bulldog-mirror |
| File name: | PO-13918.jpeg.exe |
| Download: | download sample |
| Signature | NetWire |
| File size: | 833'536 bytes |
| First seen: | 2021-07-14 05:57:20 UTC |
| Last seen: | 2021-07-14 06:47:14 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger) |
| ssdeep | 12288:btojrHrNls9XOd4+QC1KREDMALh+GMsoh4cN3K18GJTEMUzI/z55qs3IuQTL5QKL:btEKGDXh+GMsoXN3S8Gb/WyIZ |
| Threatray | 477 similar samples on MalwareBazaar |
| TLSH | T162057C6C23FEA709F233FF346FA1A7489FA666B59215DD0D1DC4024B4821C85AEA7D31 |
| Reporter |  lowmal3 |
| Tags: | exe NetWire |
Intelligence
File Origin
# of uploads :
2
# of downloads :
272
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
PO-13918.jpeg.exe
Verdict:
Malicious activity
Analysis date:
2021-07-14 05:59:32 UTC
Tags:
trojan netwire rat
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
NetWire RAT
Verdict:
Malicious
Result
Threat name:
NetWire
Detection:
malicious
Classification:
troj.spyw.evad
Score:
96 / 100
Signature
.NET source code contains very large strings
C2 URLs / IPs found in malware configuration
Contains functionality to steal Chrome passwords or cookies
Found malware configuration
Machine Learning detection for dropped file
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected NetWire RAT
Behaviour
Behavior Graph:
Detection:
netwire
Threat name:
ByteCode-MSIL.Backdoor.NetWiredRc
Status:
Malicious
First seen:
2021-07-14 05:58:06 UTC
AV detection:
13 of 46 (28.26%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
netwirerc
Similar samples:
+ 467 additional samples on MalwareBazaar
Result
Malware family:
netwire
Score:
10/10
Tags:
family:netwire botnet rat stealer
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
NetWire RAT payload
Netwire
Malware Config
C2 Extraction:
netwire.linkpc.net:6000
Unpacked files
SH256 hash:
96dbc52f7173a36475fb500a6f70f1b73481913999b17e8dbf88a6e7a59fe92e
MD5 hash:
2c66e6079eb63b33e3fa960d73fa1d58
SHA1 hash:
e1b23f173e76349f0185fa474cc3750b981a2817
SH256 hash:
2b54fd77d3e3518a7ce2f64dc1c337fdcac47e2bab44572fee3ca4f3ab082d56
MD5 hash:
cd270aeba0537566f8f9d7bc09f64357
SHA1 hash:
d486f722eec37e4c49b670a1fb8ce948e2f50b94
Detections:
win_netwire_g1
win_netwire_auto
SH256 hash:
5e694edc155ca22f66c84012318bf4d60c91a8d17f3b342090c1b0ce462f8f8e
MD5 hash:
5b64cb77ca135a566f0e6e6b432414d1
SHA1 hash:
8d3c5f7d36c118cf5a626407508448c4dcd8389d
SH256 hash:
5f5257e30cfc2caab058013ffc60f90fb8a5d780a14834e1371054290b7658e4
MD5 hash:
b0e14c3526d6623ae9b7b5f5e0efde76
SHA1 hash:
f7d127bff2dfb1100ebd55fdd12dfb7a2b382fdc
SH256 hash:
ff32e93cbeacbeda2437159fc90e1c0a4b6b1d7fa160a931fe80801ba6e3311d
MD5 hash:
39354b7b1d0dda28b95785b967621c07
SHA1 hash:
e0e21df731ac7e2bcaa1fa1ca0a3f12936a111a4
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_SUSPICIOUS_Binary_References_Browsers |
|---|---|
| Author: | ditekSHen |
| Description: | Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. |
| Rule name: | MALWARE_Win_NetWire |
|---|---|
| Author: | ditekSHen |
| Description: | Detects NetWire RAT |
| Rule name: | pe_imphash |
|---|
| Rule name: | Skystars_Malware_Imphash |
|---|---|
| Author: | Skystars LightDefender |
| Description: | imphash |
| Rule name: | win_netwire_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.netwire. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.