MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9dd9dcea8897935e1ad2495d33b9236228dac772ca825cc67c90938bb29aa419. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9dd9dcea8897935e1ad2495d33b9236228dac772ca825cc67c90938bb29aa419
SHA3-384 hash: 8231706c4fc90f58ebe6c681400b99de71a58fae7eda1af685c632ed2a672f6bc85ae0919699a9a2e612d6657c711464
SHA1 hash: d721cf61114d0015af33b877fea4b6620075f0a1
MD5 hash: f047630b6bdd86310d4576a63a94ada6
humanhash: nuts-blossom-muppet-idaho
File name:PROOF OF PAYMENT.UUE
Download: download sample
Signature NetWire
Create hunting rule
File size:889'136 bytes
First seen:2020-06-02 07:18:11 UTC
Last seen:Never
File type:unknown
MIME type:application/vnd.ms-cab-compressed
ssdeep 24576:3m9vvaLdQpiG+M4PM0gHzYcE1k+EMyMI7eYR8SFKflh:3m9vvIQptg00gHcNLyMI7e88nNh
TLSH 551533D850C4BBCEEBEB2C7016B6E7927586F2064CBC791F942A14953A589C33E316C7
Reporter abuse_ch
Tags:NetWire RAT uue


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: server.jcweb.co.za
Sending IP: 164.160.89.119
From: gino@propropshafts.co.za
Subject: Proof of payment `
Attachment: PROOF OF PAYMENT.UUE (contains "Proof Of Payment.exe")

NetWire RAT C2:
154.16.93.177:3365

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Frs
Create hunting rule
Status:
Malicious
First seen:
2020-06-01 16:01:31 UTC
File Type:
Binary (Archive)
Extracted files:
9
AV detection:
22 of 48 (45.83%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=txm5z2uis6jv4gwsjfothojdmiunvr3szkbfzrt4scjyxmu2uqmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

unknown 9dd9dcea8897935e1ad2495d33b9236228dac772ca825cc67c90938bb29aa419

(this sample)

NetWire

Executable exe 9e1de81ecb080a9d970953a62de72b6a83cc61776409098f1429c11032cbfa14

  
Dropping
MD5 121b665f158aa269dfdd6d701c4af31d
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9e1de81ecb080a9d970953a62de72b6a83cc61776409098f1429c11032cbfa14

Comments