MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db5038d60d1f0ee2f57fe0b3ee12f80ff10a90e088bd3316632036f4238823bf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db5038d60d1f0ee2f57fe0b3ee12f80ff10a90e088bd3316632036f4238823bf
SHA3-384 hash: 4852a5ed6b0bcbff29f5bc6d160fcb856b5ea6d5284847ab582bb6a5206025b935e806c492b1a9df468f269525481483
SHA1 hash: afe30c445587aa62cf11d54153e1d3d419cd28e7
MD5 hash: 3a4afbbc9f18b16ab620dfa374beeac7
humanhash: nine-spring-nine-queen
File name:UNICEF COVID-19 APP.arj
Download: download sample
Signature NetWire
Create hunting rule
File size:1'173'142 bytes
First seen:2020-03-16 11:52:15 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 24576:j90ugC4GmXDpGOFBy1oQz51Wdya5rN0nuX2Thb2Bnhc1vRmKq9Y:juuWT45Heh0nBb2B25jqm
TLSH ED45332EB22760621AFDB8674363D45D3813907B7C6B5F8046044EF29937E677BCE898
Reporter cocaman
Tags:arj COVID-19 NetWire

Intelligence

File Origin
# of uploads :
1
# of downloads :
95
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-03-16 16:02:05 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3nidrvqnd4hof5l74cz64exyb7yqveharc6tgftdea3pii4ieo7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/db5038d60d1f0ee2f57fe0b3ee12f80ff10a90e088bd3316632036f4238823bf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

arj db5038d60d1f0ee2f57fe0b3ee12f80ff10a90e088bd3316632036f4238823bf

(this sample)

NetWire

Executable exe 1b15ef17ccb1a99c3953f61de01ebceaeef2277b3b5939408050dc7c1010d1bb

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1b15ef17ccb1a99c3953f61de01ebceaeef2277b3b5939408050dc7c1010d1bb

Comments


Avatar
Corsin Camichel commented on 2020-03-16 12:01:05 UTC

Sent by email, imitating UNICEF

Subject: UNICEF COVID-19 TIPS APP
From: "UNICEF Inc" <swift@allcounty[.]com>