MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b6f651e15800f131c43b4711c61a1619f888b8b3d09bd9c88f1a039b5a806c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b6f651e15800f131c43b4711c61a1619f888b8b3d09bd9c88f1a039b5a806c6
SHA3-384 hash: 5da6631ef1419e7298a7fae7e1245d78a2559b6ce58196a9fc8803f038c8c364818dcfceec6d357db634f16346b82ebb
SHA1 hash: 4bcf952db7b90756c8a4d2fbbd717af1c06a057d
MD5 hash: 060a625ffd9139618e5f617eddd61b1c
humanhash: apart-coffee-alanine-eleven
File name:Proof of payment.cab
Download: download sample
Signature NetWire
Create hunting rule
File size:828'922 bytes
First seen:2020-06-15 11:17:08 UTC
Last seen:2020-06-15 12:28:33 UTC
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 24576:xH9vvaLdRePeM0QCK/oJZQDvxwsqoFQYcYq8+Rz:x9vvIueMGgvxgo6DRz
TLSH 3B05230260429BEFD58465BFC0046F0F0442A8E0D4ADDD654AF9E9E78B5B7B0F76ACC9
Reporter cocaman
Tags:cab NetWire


Avatar
cocaman
Malicious email
From: "Krunal Vaghela" <info@foxsash.com>
Received: from foxsash.com (151-248-126-10.xen.vps.regruhosting.ru [151.248.126.10])
Date: Mon, 15 Jun 2020 14:16:05 +0400
Subject: forward proof of payment
Attachment: Proof of payment.cab

Intelligence

File Origin
# of uploads :
2
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-15 11:19:03 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
22 of 31 (70.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tnxwkhqvqahrghcdwryryynbmgpyrc4lhue33hei6gqdtnnia3da._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

cab 9b6f651e15800f131c43b4711c61a1619f888b8b3d09bd9c88f1a039b5a806c6

(this sample)

NetWire

Executable exe 734dd373ee6950a0b13f4042cd66b0c3edc72df6d56f44a8afa69826e850f029

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 734dd373ee6950a0b13f4042cd66b0c3edc72df6d56f44a8afa69826e850f029
  
Dropping
MD5 04169d67b6f807a9568cec8840f31e99

Comments