MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d3c3bc440706da3a0159404850f51f8d560f53c6c9ba66b7e148aeffd80676a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d3c3bc440706da3a0159404850f51f8d560f53c6c9ba66b7e148aeffd80676a
SHA3-384 hash: 5938207da4d7464832f683dca010b6f95ff22e22cddd02db6ad1b9ac562473be405cee6b81b9be7f850937bcb98fd142
SHA1 hash: 6b3cf523428546618224b01e6a6d2277045c4024
MD5 hash: 9fb0c06861573d6f8412ac9ddc8bc186
humanhash: december-apart-fish-magazine
File name:Purchase Order.rar
Download: download sample
Signature NetWire
Create hunting rule
File size:391'415 bytes
First seen:2020-06-11 06:25:19 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:3QMXH2ODNjAtTJueaKbzGox3tK+QhuaAncyw7DIoxezbBf9n9GhJ7y9r2hqvKo8L:A4zDNctBbzJdZpn+DI+i1f99iJ7ppPiK
TLSH 428423AD63A0C34EE188EE6CFC4F1156703C945DF61AD0498A9D95B0CB9E3CD91E849F
Reporter abuse_ch
Tags:NetWire rar RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: shbc10.ultina.jp
Sending IP: 218.40.207.10
From: sales05 <contact@hesp.com>
Subject: REQUEST FOR QUOTATION
Attachment: Purchase Order.rar (contains "Purchase Order.exe")

NetWireRAT C2:
franklysky2020.ddns.net (178.62.81.235)

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2020-06-11 06:27:04 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bu6dxrcaobw2hiavsqcikd2r7dkwb5j4nsn2m236csfo77mam5va._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

rar 0d3c3bc440706da3a0159404850f51f8d560f53c6c9ba66b7e148aeffd80676a

(this sample)

NetWire

Executable exe f2c4b98fdadf7b1fec173ed6493daaaf1dbb13d8d659a73d9a6b494f32a750fb

  
Dropping
MD5 b3cdfca71a06fd29492bd14acb700f22
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f2c4b98fdadf7b1fec173ed6493daaaf1dbb13d8d659a73d9a6b494f32a750fb

Comments