MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a16c2ce4087427f7ea26a1100bebb47a9d5cc46cb9490a1213a29f904d7e62a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a16c2ce4087427f7ea26a1100bebb47a9d5cc46cb9490a1213a29f904d7e62a5
SHA3-384 hash: 30aac7992dfc0a9450606a43abef5fae8dcd5c3ae683fab9665452fc81161b1418062fc633afde6a116332b3d32961d6
SHA1 hash: ea76747348f5edc0453976d0c9fb2b7b424e8306
MD5 hash: 38963cf2710e9d4a825893a5673b7281
humanhash: oven-georgia-maine-florida
File name:RE_PEDIDO N 867.img
Download: download sample
Signature NetWire
Create hunting rule
File size:1'222'656 bytes
First seen:2020-08-05 12:15:44 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:NZpE9H571kzgTFt2/OeL5rPOrC7DLpwkpwpuyK:jpE9degTFtarPOrC7DLpDpty
TLSH FE45D0603980DE9DCC2E0F3078676800EBF1AD461A56F64FAC9B79EC57F66864D1A70C
Reporter abuse_ch
Tags:img NetWire RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: kvm450.elocom.es
Sending IP: 91.121.226.57
From: Inmaculada Hernandez <elocom@elocom.com>
Subject: RE_PEDIDO Nº 867
Attachment: RE_PEDIDO N 867.img (contains "IMG SCAN COPY PO ORDER.exe")

NetWire RAT C2:
twohoes.duckdns.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
298
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.CIL.HeapOverride.Heur.21223.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a16c2ce4087427f7ea26a1100bebb47a9d5cc46cb9490a1213a29f904d7e62a5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 12:17:07 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ufwczzaioqt7p2rgueiax25upkovzrdmxfequeqtukpzatl6mksq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a16c2ce4087427f7ea26a1100bebb47a9d5cc46cb9490a1213a29f904d7e62a5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

img a16c2ce4087427f7ea26a1100bebb47a9d5cc46cb9490a1213a29f904d7e62a5

(this sample)

NetWire

Executable exe 1ac8944d42d3a594940bbd74613193bc47430b6c6c958caf9a5b4521bd9efb91

  
Dropping
MD5 d939a9aa374ef97b17cbaa102ddab108
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1ac8944d42d3a594940bbd74613193bc47430b6c6c958caf9a5b4521bd9efb91

Comments