MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7707bead406041ea234d7249f0fc9cbb3e311794856ad6446e04d0e1062cd637. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7707bead406041ea234d7249f0fc9cbb3e311794856ad6446e04d0e1062cd637
SHA3-384 hash: b50cfacff4632bd7bfddd70ba45622d05aad661af1410ca9faca45af5ff0e232619c8519f6466b195f05d1528a1eb229
SHA1 hash: f608f3a45bcb8890b7e54397e438cef75d8e599c
MD5 hash: beadc5793699fe8d3db502245f5a23db
humanhash: uranus-low-washington-mockingbird
File name:MORE_INFORMATIONS.doc.zip
Download: download sample
Signature NetWire
Create hunting rule
File size:1'403'380 bytes
First seen:2020-08-15 06:02:37 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:qs4GNIjp3WQHSZOENT17q+dglb54bEtADdNVM5:l4GyxWQytNTHqQhhLe
TLSH 9055338C7D874C7C3B5C6F6B33087F8A06BBCB85CF7186066A326A35A36DA5058C61D4
Reporter abuse_ch
Tags:NetWire RAT zip


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: outsmtp02.sadecehosting.com
Sending IP: 77.92.152.38
From: defnenet@rcp01.hosting.sh.com.tr
Reply-To: mdaan23480@gmail.com
Subject: COOPARATION OFFER
Attachment: MORE_INFORMATIONS.doc.zip (contains "MORE INFORMATIONS.doc.exe")

NetWire RAT C2:
djohn-fax.home-webserver.de:1020 (88.198.101.62)

Intelligence

File Origin
# of uploads :
1
# of downloads :
284
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.25512.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7707bead406041ea234d7249f0fc9cbb3e311794856ad6446e04d0e1062cd637/
Threat name:
ByteCode-MSIL.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2020-08-15 06:04:08 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=o4d35lkamba6ui2noje7b7e4xm7dcf4uqvvnmrdoatiocbrm2y3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/7707bead406041ea234d7249f0fc9cbb3e311794856ad6446e04d0e1062cd637

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

zip 7707bead406041ea234d7249f0fc9cbb3e311794856ad6446e04d0e1062cd637

(this sample)

NetWire

Executable exe f847c4abf2105e997260161da48567968b7be870ae8e92e2ec6e5959e556bb5e

  
Dropping
MD5 aff3a4ce7643f274aaa725c69982b39a
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f847c4abf2105e997260161da48567968b7be870ae8e92e2ec6e5959e556bb5e

Comments