MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77b659265d987599ec3e52573369be030998636bf27d703034b499cb270f2a6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77b659265d987599ec3e52573369be030998636bf27d703034b499cb270f2a6b
SHA3-384 hash: a2416ab2d215d773a2f4eb6a230083a06f9d1c75c31f4955f2c05a481e9515adb4fcdee1ad2f6cac20bfc2eaa646c5a5
SHA1 hash: 3b70e3dc22c0f20f18d8c5611a50b7a05a2aedde
MD5 hash: dfa01e3a895cfcf12a8917d89823f9cb
humanhash: nebraska-december-green-robin
File name:PaymentConfirmation.tar
Download: download sample
Signature NetWire
Create hunting rule
File size:342'222 bytes
First seen:2020-11-19 07:14:58 UTC
Last seen:Never
File type: tar
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:B08ztPNDbaWlV0bXmemXTKF61h/SIzgua818VX9FGwFB7BURPbU:3nuRFoBS0Da8qVXpB7eRPI
TLSH 7A74234C4574AE49EB8934F4C32CEC514D483FE9AACC69F53C544EAAC8E1019AF62D4F
Reporter abuse_ch
Tags:NetWire RAT tar


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: mail.getemails.space
Sending IP: 45.147.162.68
From: Stardardbank <admin@getemails.uno>
Reply-To: noreply@standardbank.co.za
Subject: PaymentConfirmation
Attachment: PaymentConfirmation.tar (contains "PaymentConfirmation.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
314
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/77b659265d987599ec3e52573369be030998636bf27d703034b499cb270f2a6b/
Threat name:
ByteCode-MSIL.Trojan.Sudloader
Create hunting rule
Status:
Malicious
First seen:
2020-11-19 07:15:05 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o63fsjs5tb2zt3b6kjltg2n6amezqy3l6j6xambuwsm4wjypfjvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

tar 77b659265d987599ec3e52573369be030998636bf27d703034b499cb270f2a6b

(this sample)

NetWire

Executable exe 5bfba7235e133fb4c8b63e98c4b7d227e5ef5ebc44dc81c6fa95cf76fe2c22bb

  
Dropping
MD5 ecc09a255547ec12aa086f06e4205a4a
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5bfba7235e133fb4c8b63e98c4b7d227e5ef5ebc44dc81c6fa95cf76fe2c22bb

Comments