MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5c572c11d8de24eab62bf998ff173d0dafb468ee5120ad6acee28040d247790. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5c572c11d8de24eab62bf998ff173d0dafb468ee5120ad6acee28040d247790
SHA3-384 hash: b6e7d548f0f9a3d837ed0191908268c135960391e5738de9cb3be0976f28317aefd7bf3707d20f12583cab395a667ce7
SHA1 hash: 79ed29fa22f35fb26f64a67cf1c409cf6d839b14
MD5 hash: 7d386cdcd66ece04d2e0e69de5209078
humanhash: pip-delta-seven-nuts
File name:2018 1040with_w2.zip
Download: download sample
Signature NetWire
Create hunting rule
File size:680'308 bytes
First seen:2020-05-08 08:08:36 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:AfcOzcqIQ35go9v+eAOMfjtMbQOcl+i5uiu0+RGChd0qW2NAAuIR:Axzcqt5l92OAWU/lZuiu/IAKhbm
TLSH 87E423123685E881CF84232ED958D12911F8D1393B7DD6DBDFD8AC488DB1C923A8D7B9
Reporter abuse_ch
Tags:GuLoader NetWire RAT zip


Avatar
abuse_ch
Malspam distributing GuLoader:

HELO: raq.wingnets.ne.jp
Sending IP: 210.230.216.239
From: LAWRENCE L LAM <arrrc@scoutnet.or.jp>
Reply-To: LAWRENCE L LAM <LAWRENCELAM@SSCOMSTORE.COM>
Subject: Tax Preparer Needed! 5/7/2020
Attachment: 2018 1040with_w2.zip (contains "2018 1040with w2.xls")

Excel (xls) -> GuLoader -> NetWire RAT

GuLoader payload URL:
http://securewedreesdsa3.ru/Underernringen.exe

NetWire payload URL:
http://stubbackup.ru/r4_FYUuBS170.bin

NetWire RAT C2:
79.124.8.7:1986

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.TrojanDownloader.VBA.MalDoc.ali1000103.29954.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Document-Word.Trojan.Eagent
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 08:36:21 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4xcxfqi5rxre5k3cx6my74lt2dnpwruo4ujavvvm5yuaidjeo6ia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

zip e5c572c11d8de24eab62bf998ff173d0dafb468ee5120ad6acee28040d247790

(this sample)

NetWire

Executable exe 79a11cb21ee047550839c1bb8e4bd7d40c98b7fc8eb1faf5f71c06d8acadcdb5

NetWire

Excel file xls 13e668992868756df857fe968a7de8f492511b410a076e551e862ce0abf5489f

  
Dropping
MD5 56efb9d16729dca7ee3cd0e6b36bc760
  
Dropping
GuLoader
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 13e668992868756df857fe968a7de8f492511b410a076e551e862ce0abf5489f

Comments