MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7288ad25862d2c68fb46681dc61aacda3a025db5228f1c71b353660e9307f794. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7288ad25862d2c68fb46681dc61aacda3a025db5228f1c71b353660e9307f794
SHA3-384 hash: 5bbf66df1fd7325716ae995a967943a154b616621f691a5cddf49187c1d97b292218e59a3a341f001587748fdff2676b
SHA1 hash: 3b24323749e34b0940292bc9a25ddf83ca52ef3a
MD5 hash: f2ea70e97955bfa5b3533412e44f0899
humanhash: nitrogen-illinois-bacon-magazine
File name:TNT TRACKING DETAILS.pdf.z
Download: download sample
Signature NetWire
Create hunting rule
File size:195'942 bytes
First seen:2021-01-08 07:05:11 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 3072:7ALCTTR0XQD5Oa+dzAIkCpzxhXu64dRNv5LZhdnYvGnFARNcM0cacOqTp1fdOLWg:7ICuXQ4a+AIlDQdR5niGnWATu3OLr
TLSH 28141204277195649C6C442B8F46A34D2F0BC5E05DF9C3F6192BB94E3CF2A9BA35C9B8
Reporter abuse_ch
Tags:NetWire RAT TNT z


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: server.amandianaeze.ga
Sending IP: 37.77.106.252
From: TNT EXPRESS INC <tnt@amandianaeze.ga>
Subject: Consignment Notification: You have A Package With Us
Attachment: TNT TRACKING DETAILS.pdf.z (contains "TNT TRACKING DETAILS.exe")

NetWire RAT C2:
ceo2021.duckdns.org:5594 (185.150.24.55)

Intelligence

File Origin
# of uploads :
1
# of downloads :
285
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7288ad25862d2c68fb46681dc61aacda3a025db5228f1c71b353660e9307f794/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-08 07:06:06 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=okek2jmgfuwgr62gnao4mgvm3i5aexnvekhry4ntknta5eyh66ka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7288ad25862d2c68fb46681dc61aacda3a025db5228f1c71b353660e9307f794

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

z 7288ad25862d2c68fb46681dc61aacda3a025db5228f1c71b353660e9307f794

(this sample)

NetWire

Executable exe fefea87ebfbd43c789033d46905fd2a11b8ea9d4c6b57691f23a89e8f8687992

  
Dropping
MD5 740a1985261bb2bd22b6dc7ffbdefc9d
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fefea87ebfbd43c789033d46905fd2a11b8ea9d4c6b57691f23a89e8f8687992

Comments