MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38ad22c4e0652fc6a0fdf444a0537046921a72bd3ca43f6a30649308ae332632. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38ad22c4e0652fc6a0fdf444a0537046921a72bd3ca43f6a30649308ae332632
SHA3-384 hash: 6ab1e876669011778ad23fa29aec621e4b0166587fc8a22864114aa43a7187c785fc6ac62e5a221ea7607c56c8c51e48
SHA1 hash: 64472c336c395a8878b5ebb2b0c7cb7a42a6e266
MD5 hash: ac1d5440c9972dca50c9943109dcbbd0
humanhash: carbon-cola-mike-fish
File name:SMPP Price List.rar
Download: download sample
Signature NetWire
Create hunting rule
File size:208'604 bytes
First seen:2020-11-07 09:44:48 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:g6Y7rCZz9c+UG4SK4/veixUXA/kUZztqdso9XotdSVv6jX0NfXWYF7iTejMr/8p5:HYHCM+UJAxU45aXotd927sVa
TLSH 871423B1B52303DD6A69C603A6C157C831240A7A14CFFB16BDD9E9AAB534F174FA1C31
Reporter abuse_ch
Tags:NetWire rar RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: rx4512.rapidns.com
Sending IP: 180.149.244.235
From: Support <support@tanla.com>
Reply-To: Support <support@tanla.com>
Subject: Smpp price changed
Attachment: SMPP Price List.rar (contains "SMPP Price List.COM")

NetWire RAT C2:
iphanyi.entrydns.org:3360 (150.242.14.61)

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/38ad22c4e0652fc6a0fdf444a0537046921a72bd3ca43f6a30649308ae332632/
Threat name:
ByteCode-MSIL.Ransomware.TeslaCrypt
Create hunting rule
Status:
Malicious
First seen:
2020-11-06 13:45:29 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hcwsfrhamux4nih56rckau3qi2jbu4v5hssd62rqmsjqrlrteyza._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

rar 38ad22c4e0652fc6a0fdf444a0537046921a72bd3ca43f6a30649308ae332632

(this sample)

NetWire

Executable exe a21c1907825a9f0639f847c15963a01ee0fb73eeb2e23426cd3dec88713083b1

  
Dropping
MD5 2ee9d75b8e3eb9c5a58560083d6707ba
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a21c1907825a9f0639f847c15963a01ee0fb73eeb2e23426cd3dec88713083b1

Comments