MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13e54369ce99cce1af1556fd96a7654ec1219ae60a8e1430a9c69143fc912153. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13e54369ce99cce1af1556fd96a7654ec1219ae60a8e1430a9c69143fc912153
SHA3-384 hash: 3a1e551f534c134488640445559abdb10eefd6e2fdab42f7743f667c27edc1e11e41b3d2419d9b7321170fa077201597
SHA1 hash: 2fc5f019037feb898fe45ca444647ab5df8f0520
MD5 hash: 325d32893414a33ab3bcffb1a49e49f2
humanhash: oranges-asparagus-eighteen-ohio
File name:Transaction Receipt6720.iso
Download: download sample
Signature NetWire
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-28 05:42:34 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:2Wq2iB5zzVMz9sVhJwP7mCOvA8uSrWxtuk28QHgW:of5zCMAXQ6AWx4kZ0d
TLSH E0458D3C1AA91327D67DE3754ED44517F4F4A42B3016EE19ACCF039D4B89A4AB6C223E
Reporter abuse_ch
Tags:iso NetWire RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: e-tiptox.site
Sending IP: 62.173.140.204
From: Hit Promotional Products <support@e-tiptox.site>
Reply-To: pmperfect@protonmail.com
Subject: Transaction Receipt#6720 Hit Promotional Products
Attachment: Transaction Receipt6720.iso (contains "TRANSACTION RECEIPT#6719.exe")

NetWire RAT C2:
5.9.84.209:1011

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EKOW.22318.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 06:36:31 UTC
File Type:
Binary (Archive)
AV detection:
14 of 31 (45.16%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

iso 13e54369ce99cce1af1556fd96a7654ec1219ae60a8e1430a9c69143fc912153

(this sample)

NetWire

Executable exe 1cc4b7a9c9d0d8de1ab96f11189104912af60a594c7e4a0c70d7cc236fdbb6ec

  
Dropping
MD5 31c594daa24b28d6d6102ed84aafb204
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1cc4b7a9c9d0d8de1ab96f11189104912af60a594c7e4a0c70d7cc236fdbb6ec

Comments