MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b9d3f96638c6e5cc8e13ac41444202c259fef81bf8f73fc0a6d7169b4dcf65c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b9d3f96638c6e5cc8e13ac41444202c259fef81bf8f73fc0a6d7169b4dcf65c
SHA3-384 hash: b832c6ccc897cf9f7c68fc0abf0bc0323656c99493313c64e86ebba5976bb7dff41b64e271e6c2a0d392f91778e02e70
SHA1 hash: 400ec332bd4f298b3956b6c34376aa6d9eef7302
MD5 hash: 4fc4d789a8f3a351a8915f34d9cd0e86
humanhash: ohio-minnesota-johnny-rugby
File name:Host.zip
Download: download sample
Signature NetWire
Create hunting rule
File size:53'802 bytes
First seen:2020-05-24 06:50:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1536:KoAtKSEcv+/lIVNF46ZNLcYm7+ibZ+ThPjzKIGlf:2tkiipTcT9SIGlf
TLSH 6733020480882BA6D3FD8477AF9B9F1B98CEFA7B77DC9C448154A911630F619470B39A
Reporter abuse_ch
Tags:NetWire RAT zip


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: skizzle.texo.co.za
Sending IP: 129.232.230.50
From: accounts@recycle1st.co.za
Subject: Payment Info
Attachment: Host.zip (contains "Host.exe")

NetWire RAT C2:
154.16.93.177:3365

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Razy-6703914-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Weecnaw
Create hunting rule
Status:
Malicious
First seen:
2020-05-24 07:35:41 UTC
File Type:
Binary (Archive)
Extracted files:
1
AV detection:
37 of 48 (77.08%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

zip 4b9d3f96638c6e5cc8e13ac41444202c259fef81bf8f73fc0a6d7169b4dcf65c

(this sample)

NetWire

Executable exe db07bff94b6ace3907b55971ba6234e6b232a66f2efd18425c7e21204025e6e3

  
Dropping
MD5 61ee418bec8cbd31f026ab491e2fa969
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 db07bff94b6ace3907b55971ba6234e6b232a66f2efd18425c7e21204025e6e3

Comments