MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9fa55761cbb245c1f1ffae0470cac581ad2c6483e2ff35e55d1c92a66f938b44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9fa55761cbb245c1f1ffae0470cac581ad2c6483e2ff35e55d1c92a66f938b44
SHA3-384 hash: 21fbebfc4b54d7cbc8ca451ad6e142476fe27377757379fcf777d0031b23df3b6ddeeb8b1a377846c681e951d9a136a9
SHA1 hash: 5bc4a1bc018bda0c5486cac927823fd975df8e74
MD5 hash: a732fb8a6b8aa55b295340f56b1c9cd2
humanhash: washington-harry-papa-fish
File name:Quotation 21946 3MuR7U.xz
Download: download sample
Signature NetWire
Create hunting rule
File size:317'317 bytes
First seen:2020-08-05 09:24:05 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 6144:F1ClAEOYjcX93q8qHbk6ckPozlXQ3qmQM3FC26iJICbS6:m/Zjc1XObk6qz+3BQ8C2lJD3
TLSH C26423957EBF967509A7E1CFA3001BFE226B8B4113AE1A75199189B735086C4CE2F331
Reporter abuse_ch
Tags:NetWire RAT xz


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: futureomanllc.com
Sending IP: 185.222.57.207
From: Vishnu Satheesh <ftmct@futureomanllc.com>
Subject: Quotation 21946 3MuR7U 202630 U8t3
Attachment: Quotation 21946 3MuR7U.xz (contains "Quotation 21946 3MuR7U.exe")

NetWire RAT C2:
evapimp.myq-see.com

Intelligence

File Origin
# of uploads :
1
# of downloads :
292
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9fa55761cbb245c1f1ffae0470cac581ad2c6483e2ff35e55d1c92a66f938b44/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 07:25:00 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t6svoyolwjc4d4p7vychbswfqgwsyzed4l7tlzk5dsjkm34trnca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9fa55761cbb245c1f1ffae0470cac581ad2c6483e2ff35e55d1c92a66f938b44

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

xz 9fa55761cbb245c1f1ffae0470cac581ad2c6483e2ff35e55d1c92a66f938b44

(this sample)

NetWire

Executable exe 2e54ae1fe78471492cc217d238fcd7f0158ae8f22a35e9576a91b3a6614c2d08

  
Dropping
MD5 b5f8fb837bc7904e1689291c8d64b1ad
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2e54ae1fe78471492cc217d238fcd7f0158ae8f22a35e9576a91b3a6614c2d08

Comments