MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ef882d5c3d96863d0f67638df07f034dd056ea6bf0d29b0cf50ae4e24809efd1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ef882d5c3d96863d0f67638df07f034dd056ea6bf0d29b0cf50ae4e24809efd1
SHA3-384 hash: 4366da4617d6dc8f88083b045c18cf07f188912c8c82c42bed3762341ed73ceeb41bd48b6e178b8a20228c4e9104e7b0
SHA1 hash: f8fb0b9f3aca093779ba36a66e6d4d479c4478f0
MD5 hash: 8c6aa529ce7caff2e1e22616ba4c052c
humanhash: apart-five-potato-massachusetts
File name:Bonatti Order 17.08.2020.iso
Download: download sample
Signature NetWire
Create hunting rule
File size:927'744 bytes
First seen:2020-08-17 19:06:51 UTC
Last seen:2020-08-18 05:29:31 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:qHlYcrKanXHzeEjMx6p4ddVvjUip3GKfm8Lon+CyC0WUILwJ7:qF7OuHzkK4d7403c8UnRUIsJ
TLSH 8915AE22B1E34836D0B22A785C1F72A89836BF1039FF99477BE47D088F396513565E87
Reporter abuse_ch
Tags:iso NetWire


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.kulmanorders.com
Sending IP: 107.158.163.9
From: Bonatti International Company <info@kulmanorders.com>
Reply-To: Bonatti International Company <milene.yuchi@gmail.com>
Subject: RFQ BONATTI 18000229 IQ1201 WO 210000102767
Attachment: Bonatti Order 17.08.2020.iso (contains "BONATTI 18000229 IQ1201 WO 210000102767.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
271
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.BScope.Trojan.Crypt.5088.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ef882d5c3d96863d0f67638df07f034dd056ea6bf0d29b0cf50ae4e24809efd1/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-17 10:22:31 UTC
File Type:
Binary (Archive)
Extracted files:
66
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=56ec2xb5s2dd2d3hmog7a7ydjxifn2tl6djjwdhvblsoesaj57iq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ef882d5c3d96863d0f67638df07f034dd056ea6bf0d29b0cf50ae4e24809efd1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

iso ef882d5c3d96863d0f67638df07f034dd056ea6bf0d29b0cf50ae4e24809efd1

(this sample)

NetWire

Executable exe 608ec84d6c6d1b552b0c77210475ead69a437d02cc688d60e798cf530c02897e

  
Dropping
MD5 27058c216d332e3e2ed96892c4ac0b04
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 608ec84d6c6d1b552b0c77210475ead69a437d02cc688d60e798cf530c02897e

Comments