MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18b2ed9143f0a38ade915132eb75ee4d36e650fa17c5c4020853bb85648197c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18b2ed9143f0a38ade915132eb75ee4d36e650fa17c5c4020853bb85648197c4
SHA3-384 hash: ba5d1b2011aa46cbca8b2fcdca6d79cb247ab7e576d6b5e5717a48a3246e0235a5f30c711950c17005d8841550a71597
SHA1 hash: ac1f98da12cbba95b0b887e07eda2b0ce77dae68
MD5 hash: e39e6269fc02359a1fdedb8ba4c6f6a7
humanhash: four-bakerloo-jupiter-stairway
File name:TNT TRACKING DETAILS.PDF.z
Download: download sample
Signature NetWire
Create hunting rule
File size:196'549 bytes
First seen:2021-01-08 06:46:41 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 3072:bvXzFI/l5+URADOdkA29RA8UHqBDW/ZWlfC15e+eM7VlQNm9U6nJj5WIZDuUe6Jk:LXzF8l5+EsrRwH8IZW41AfI6Nm9U6LdW
TLSH 801423F3574DB329F960E1C8FF216FB3FA6C153523482A2B68705B20AB94658C0B9756
Reporter abuse_ch
Tags:NetWire RAT TNT z


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: server.amandianaeze.ga
Sending IP: 37.77.106.252
From: TNT EXPRESS INC <tnt@amandianaeze.ga>
Subject: Consignment Notification: You have A Package With Us
Attachment: TNT TRACKING DETAILS.PDF.z (contains "TNT TRACKING DETAILS.exe")

NetWire RAT C2:
ceo2021.duckdns.org:5594 (185.150.24.55)

Intelligence

File Origin
# of uploads :
1
# of downloads :
271
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18b2ed9143f0a38ade915132eb75ee4d36e650fa17c5c4020853bb85648197c4/
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2021-01-08 06:47:04 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dczo3ekd6cryvxurkezow5poju3omuh2c7c4iaqiko5ykzebs7ca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/18b2ed9143f0a38ade915132eb75ee4d36e650fa17c5c4020853bb85648197c4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

z 18b2ed9143f0a38ade915132eb75ee4d36e650fa17c5c4020853bb85648197c4

(this sample)

NetWire

Executable exe f5d88ee96cd5fbdda828c9ec267600fb6308a11318f8290d6d15d34f64070f05

  
Dropping
MD5 9ec393008bc2c14d1a385c72a72ca241
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f5d88ee96cd5fbdda828c9ec267600fb6308a11318f8290d6d15d34f64070f05

Comments