MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 87d1e23212ef405f0cc24e3d45e4ac408906e3a43964bfbf5d2e13aa1492c2fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
NetWire
Vendor detections: 4
| SHA256 hash: | 87d1e23212ef405f0cc24e3d45e4ac408906e3a43964bfbf5d2e13aa1492c2fd |
|---|---|
| SHA3-384 hash: | b5422d77838edc008c66078701c54c482f8027c1dd25c5def3b3336b34c6bfa4a1934ea1a7b5bec863202711b51a6f86 |
| SHA1 hash: | f4130d602672555fff5c5ffdb493628cd35c4444 |
| MD5 hash: | 298f29a71611a4d1458362ba485b9909 |
| humanhash: | indigo-virginia-muppet-kitten |
| File name: | SBIN32000636990,pdf.001 |
| Download: | download sample |
| Signature | NetWire |
| File size: | 493'937 bytes |
| First seen: | 2020-07-21 06:08:29 UTC |
| Last seen: | 2020-07-21 06:23:20 UTC |
| File type: | rar |
| MIME type: | application/x-rar |
| ssdeep | 12288:Ofbwb55aGF0o/xzb9aMJgeL/mh1qt1Rs4v+ody71l:Of0bPadMxQMJL/m7Yv+oM |
| TLSH | 70B4234B24379977675B60A1E3856C46EDC1E807050CCFE52BAEF7E8B27A0CE1CD06A5 |
| Reporter |  abuse_ch |
| Tags: | 001 NetWire nVpn RAT |
abuse_ch
Malspam distributing NetWire:HELO: titan.fibersunucu.com.tr
Sending IP: 188.132.179.148
From: "Alev ALKAN"<ekstre@halkbank.com.tr>
Subject: DEBIT NOTE SBIN32000636990
Attachment: SBIN32000636990,pdf.001 (contains "SBIN32000636990,pdf.scr")
NetWire RAT C2:
hurricane.myq-see.com:2310 (185.140.53.6)
Pointing to nVpn:
% Information related to '185.140.53.0 - 185.140.53.255'
% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'
inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-BE-NL4
country: EU
descr: Zaventem, Belgium
descr: Amsterdam, Netherlands
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-07-16T21:16:41Z
source: RIPE
Intelligence
File Origin
# of uploads :
2
# of downloads :
233
Origin country :
n/a
Vendor Threat Intelligence
Threat name:
Win32.Trojan.Avemariarat
Status:
Malicious
First seen:
2020-07-21 06:10:08 UTC
File Type:
Binary (Archive)
Extracted files:
47
AV detection:
18 of 29 (62.07%)
Threat level:
5/5
Detection(s):
Malicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
exe Dropping
NetWire
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.