MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82ab4f5e87b083d6193bb24edc74780e858650cb2f7ef7a9f185b40b47f6bb69. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 82ab4f5e87b083d6193bb24edc74780e858650cb2f7ef7a9f185b40b47f6bb69
SHA3-384 hash: ea04a0972082d904c6331675da300aa6cd7a9c1306ca905ccb88bbec9c3e24902f22a03d8828f068e8da3bf4b8404107
SHA1 hash: 356d93c1dc8a30c3ab0eec3079283590fcf9de09
MD5 hash: 912bf1def4943604c3e06feca9058073
humanhash: harry-ack-nebraska-oscar
File name:parcel.img
Download: download sample
Signature NetWire
Create hunting rule
File size:450'560 bytes
First seen:2021-03-04 07:25:58 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:68LxB7zyxitFJGC5zaNuvX8+TBzAKMoMzTz5bMlF:dltGC5zaEvXPA6M7AF
TLSH DDA49C13EEB2ED73C6F176FB0059B5299D2E4E910CF27586726CB949FEB3942D900182
Reporter abuse_ch
Tags:DHL img NetWire RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: dns13784.phdns20.es
Sending IP: 185.45.75.217
From: DHL International GmbH <noreply@worldwidedhl.com>
Subject: DHL EXPRESS PO#R2019416***** RE-DELIVERY NOTICE!
Attachment: parcel.img (contains "parcel.exe")

NetWire RAT C2:
goryhazel1.duckdns.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
364
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Soft32downloader-6691270-0
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/82ab4f5e87b083d6193bb24edc74780e858650cb2f7ef7a9f185b40b47f6bb69/
Threat name:
Win32.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2021-03-04 07:26:23 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qkvu6xuhwcb5mgj3wjhny5dyb2cymuglf57ppkprqw2awr7wxnuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/82ab4f5e87b083d6193bb24edc74780e858650cb2f7ef7a9f185b40b47f6bb69

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

img 82ab4f5e87b083d6193bb24edc74780e858650cb2f7ef7a9f185b40b47f6bb69

(this sample)

NetWire

Executable exe bdfb906a3a02d8a28bef1d13d0abff090bc9582373e05e5f376186e9a7c5a902

  
Dropping
MD5 f36dbd08d89de65427f8f2474507c89c
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bdfb906a3a02d8a28bef1d13d0abff090bc9582373e05e5f376186e9a7c5a902

Comments