MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33d147cae564ca6a9a201623c6348662f616a2cc054df12d8f0f0406853992e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33d147cae564ca6a9a201623c6348662f616a2cc054df12d8f0f0406853992e8
SHA3-384 hash: 94df8211f89faf892e798cc6f88454805ffbcbe4ad2b3df3d732670ae61d7609dfac39283b1e9fae319a799d218892dd
SHA1 hash: 3d7ec18a638ab14a3eaf399ae16bb3fdc93f1456
MD5 hash: 3b67f66db15655bee3b836d32217c20c
humanhash: foxtrot-network-bravo-fillet
File name:Proof of Payment.iso
Download: download sample
Signature NetWire
Create hunting rule
File size:1'310'720 bytes
First seen:2020-10-12 05:47:16 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:4gOLEguBoizzz1OXWtqu8HumoSaxHwY0MirTivlPK6:ALNizcGj8HumRfAZZ/
TLSH 0155D02227E95F86E17E8BF91224145043F53A1B396EF21D3DCA29DF1AB5F818600B77
Reporter abuse_ch
Tags:iso NetWire RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: relay.enetworks.co.za
Sending IP: 41.222.50.15
From: phmontrose <reservations@phmontrose.co.za>
Subject: Proof of Payment
Attachment: Proof of Payment.iso (contains "Proof of Payment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
154
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/33d147cae564ca6a9a201623c6348662f616a2cc054df12d8f0f0406853992e8/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-12 01:57:05 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gpiupsxfmtfgvgracyr4mnegml3bniwmavg7clmpb4canbjzslua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/33d147cae564ca6a9a201623c6348662f616a2cc054df12d8f0f0406853992e8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

iso 33d147cae564ca6a9a201623c6348662f616a2cc054df12d8f0f0406853992e8

(this sample)

NetWire

Executable exe b0f6052c071380b0413ba33ab5f888442bba649614a7102ade644d7195487bed

  
Dropping
MD5 e2e5d3eb553f14e5c684f5f85fee0aee
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b0f6052c071380b0413ba33ab5f888442bba649614a7102ade644d7195487bed

Comments