MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 43c16cfb1681c00272676cb3c7765f12b33129b45aabc28698cc2dffa79f8c68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 43c16cfb1681c00272676cb3c7765f12b33129b45aabc28698cc2dffa79f8c68
SHA3-384 hash: 5404588ec0a46b163039668e1e9697e5014f5368f40d66b5f962f58671057cd20bf486e4bdb1aa793767a83d3eed2c5d
SHA1 hash: ba8006ebdf8c5aac7046be5fe3549184ca959e45
MD5 hash: 410f2b34ad9c94a2abaab97b3caa9b18
humanhash: equal-early-oxygen-harry
File name:SWIFT-Credit Advice 0052020052056797.PDF.img
Download: download sample
Signature NetWire
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-27 06:59:20 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:QJ2aa7eeqJ95f1HmUnU3UxpLOAEr+YglMepJ8f1pOVAJU:E0eew/HmUns+LLpRy88f1pOV
TLSH 4D45AE1E57D89FA6E46BB770588331DA4034F5C32AB3F32B675935D19A2098C0CE6AC7
Reporter abuse_ch
Tags:img NetWire RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: server.avrasyarulman.com
Sending IP: 45.146.253.250
From: tradefinance.tfc@bbl.co.th <tradefinance.tfc@bbl.co.th>
Subject: BBL ADVISE SWIFT U231859-001 as at 5/26/2020 5:00:10 p.m. [0001633775]
Attachment: SWIFT-Credit Advice 0052020052056797.PDF.img (contains "SWIFT-Credit Advice 0052020052056797-PDF.exe")

NetWire RAT C2:
174.127.99.159:7882

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.MSIL.Bladabindi.1.7630.32766.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 07:14:54 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
16 of 30 (53.33%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

img 43c16cfb1681c00272676cb3c7765f12b33129b45aabc28698cc2dffa79f8c68

(this sample)

NetWire

Executable exe f0caa55fec8b5afbb9799bc2bcd8d965ef420e1138e38ef94c65a6a2037042a3

  
Dropping
MD5 dfb7f58be46e9b045affa37d0d463ed3
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f0caa55fec8b5afbb9799bc2bcd8d965ef420e1138e38ef94c65a6a2037042a3

Comments