MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4272d7e72c512c439405a9d9052b0a94fbe6c4b4eb224430c885e1c63ad78ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4272d7e72c512c439405a9d9052b0a94fbe6c4b4eb224430c885e1c63ad78ef
SHA3-384 hash: bba07d81e6e1d9db53305fce28278d60947a7acf210812ef3ae17a138c8658ad894e6d88a562f0435ac9915d6d0d1ab2
SHA1 hash: 85382361bde6235e1d4565a8eb7a9784381ef0fd
MD5 hash: 794222924f7cf88c71e0a9980a94c0e5
humanhash: pluto-ink-fourteen-november
File name:Proof of Payment.iso
Download: download sample
Signature NetWire
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-05 07:04:19 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:kJ2wtEGI4ES/RICG6B+rD4lh5ZT9WDsxNu:kJ2hG1ES/RICGTr8zbMYxN
TLSH 2545E12076A80B19D8FAA7F65934D11047B67E853273E39D5DDA31CD2A72F004B32A6F
Reporter cocaman
Tags:iso NetWire


Avatar
cocaman
Malicious email (T1566.001)
From: "Jason Bourne <admin@genoson.cf>"
Received: "from mail.genoson.cf (unknown [45.147.162.237]) "
Date: "Mon, 05 Oct 2020 18:10:47 +1200"
Subject: "Proof of Payment"
Attachment: "Proof of Payment.iso"

Intelligence

File Origin
# of uploads :
1
# of downloads :
193
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a4272d7e72c512c439405a9d9052b0a94fbe6c4b4eb224430c885e1c63ad78ef/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-05 06:21:43 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uqts27tsyujmiokalkozauvqvfh343clj2zciqymrbpbyy5npdxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a4272d7e72c512c439405a9d9052b0a94fbe6c4b4eb224430c885e1c63ad78ef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

iso a4272d7e72c512c439405a9d9052b0a94fbe6c4b4eb224430c885e1c63ad78ef

(this sample)

NetWire

Executable exe 880a3f89941849fc46d6921a4ef7326e4b2b074a505e916cac0eb1cd0f15c45f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 880a3f89941849fc46d6921a4ef7326e4b2b074a505e916cac0eb1cd0f15c45f

Comments