MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ea6d8924f94e5e5c10c97db686d4911242a7ccb030e6177cff9ccac0dfcdba4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ea6d8924f94e5e5c10c97db686d4911242a7ccb030e6177cff9ccac0dfcdba4
SHA3-384 hash: 4b0e86f157f658829e88fb52af01aea0285c8aa4dbbf2e060cb4520c0ad080a11a6ce896e9b5e45e6501b28ed1df83ff
SHA1 hash: 77db2f268896e2240a707700731566a2e98051cf
MD5 hash: e869ee3e6e14807173c0e18839633a21
humanhash: floor-tennis-ohio-table
File name:Attached file.iso
Download: download sample
Signature NetWire
Create hunting rule
File size:1'310'720 bytes
First seen:2021-03-09 15:00:43 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:NWvotGuCXzMfmdGec+DWs26KD/pxgEqsMFfD6STyl:NWvIEym4yZepRkD6STy
TLSH 7555BF33D2E06877C1731B7D6E2B435D952ABD103B39AD862AD92D885F7BBC03815287
Reporter abuse_ch
Tags:DHL iso NetWire OVPN RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: mail.issuedhl.com
Sending IP: 5.206.224.221
From: Dhl Customer Support <help@issuedhl.com>
Subject: Delivery Failed
Attachment: Attached file.iso (contains "Document.exe")

NetWire RAT C2:
legend.casacam.net:6655

Intelligence

File Origin
# of uploads :
1
# of downloads :
374
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1729.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
MALICIOUS
Gathering data
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 15:01:07 UTC
AV detection:
11 of 45 (24.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p2tnrespsts6lqims7nwq3kjcescu7glamhgc56p7hgkydp43osa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7ea6d8924f94e5e5c10c97db686d4911242a7ccb030e6177cff9ccac0dfcdba4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

iso 7ea6d8924f94e5e5c10c97db686d4911242a7ccb030e6177cff9ccac0dfcdba4

(this sample)

NetWire

Executable exe 3ffc5daa049116311ac1363623b7a8960b7aabb4b874d1126a358b8d483e33cd

  
Dropping
MD5 18ae9c064e66cc5fe426dbeaec3ed2d6
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3ffc5daa049116311ac1363623b7a8960b7aabb4b874d1126a358b8d483e33cd

Comments