MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 040a69fe6d68904cbb33cffa3930c2a9d2d4a16377c730e8db78386034e1bfd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
NetWire
Vendor detections: 5
| SHA256 hash: | 040a69fe6d68904cbb33cffa3930c2a9d2d4a16377c730e8db78386034e1bfd3 |
|---|---|
| SHA3-384 hash: | 18877ba66d1a8b2d431bae14697aed3c9d509b26a57f5fc0719c0073e8a514d4811e9970f0e62965ea87cd485e401a1d |
| SHA1 hash: | eec48e468c1b95426923c030235a6986ff8a9b08 |
| MD5 hash: | 7fe1be366dcec24af3d895a5cf6444a6 |
| humanhash: | equal-three-paris-fanta |
| File name: | Purchase order.exe |
| Download: | download sample |
| Signature | NetWire |
| File size: | 791'040 bytes |
| First seen: | 2020-06-09 05:14:45 UTC |
| Last seen: | 2020-06-09 06:08:03 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 73d9b3ff10ed798a32352fd00e581c0f (2 x ModiLoader, 1 x AveMariaRAT, 1 x NetWire) |
| ssdeep | 12288:/34SK+eKtmz7nIdq32wx6B4Xil/C+QU7K3wFXJQtF2z:gSfeT7IdqTx5XADQUlTQ2 |
| Threatray | 271 similar samples on MalwareBazaar |
| TLSH | 22F49E33F3E05433C8371A388C2B56B5E569BE106E24AC9B7BF5CE0C4E352957929297 |
| Reporter |  abuse_ch |
| Tags: | exe NetWire RAT |
abuse_ch
Malspam distributing NetWire:HELO: shbc10.ultina.jp
Sending IP: 218.40.207.10
From: sales05 <contact@hesp.com>
Reply-To: karensdwind@null.net
Subject: PRICE REQUEST FOR ORDER
Attachment: Purchase order.rar (contains "Purchase order.exe")
NetWire RAT payload URL:
https://cdn.discordapp.com/attachments/719603727690104866/719611633692966971/Jkaqcds
NetWire RAT C2:
rgussy.ddns.net:3871 (213.5.64.11)
Intelligence
File Origin
# of uploads :
2
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Infostealer.Fareit
Status:
Malicious
First seen:
2020-06-08 23:24:56 UTC
AV detection:
23 of 31 (74.19%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
netwirerc
Similar samples:
+ 261 additional samples on MalwareBazaar
Result
Malware family:
modiloader
Score:
10/10
Tags:
family:modiloader
Behaviour
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.