MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b27135b13576265f193f7fe29b886d7c093f17424fe3de2150a1bfd83386a5dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b27135b13576265f193f7fe29b886d7c093f17424fe3de2150a1bfd83386a5dd
SHA3-384 hash: 8e1fda309eb2a4334be3e43541ace943210641040474ed602b6b5fe37b00d7becfd84c97a0f72960c60b92876cc78cb0
SHA1 hash: 02149da74589119465e12ea468a98622b041e759
MD5 hash: ba7feecd03531cd8ada081f6d7207f69
humanhash: louisiana-river-december-hawaii
File name:INQ Request Order COVID-19 208548U4000209845504554.rar
Download: download sample
Signature NetWire
Create hunting rule
File size:24'258 bytes
First seen:2020-05-20 07:58:44 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:b6jU/s1yBFGOqPVtGQZuAWzbtR9E0Rf2JjinrTxeFt8KSy9hErOwUrfTcTrSUrQS:Oj+s1SG7PHUpI0MJj4NeFt8KSyzEcvcl
TLSH A1B2D1E13EABEF9F761B51BD3147A4C338905206249C9D5CC928761A58402E71FDDF72
Reporter abuse_ch
Tags:NetWire rar


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: park-mx.above.com
Sending IP: 103.224.212.34
From: Levent SARICA <contacts@g1economia.com>
Subject: Attn: uhasebe Inquiry and Request New Order YYNBHHGBAOI/ TT#
Attachment: INQ Request Order COVID-19 208548U4000209845504554.rar (contains "INQ Request Order COVID-19 208548U4000209845504554.exe")

Payload URLs:
http://naturepack.cc/files/RTXN.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-20 08:36:50 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wjytlmjvoytf6gj7p7rjxcdnpqet6f2cj7r54ikqug75qm4guxoq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

rar b27135b13576265f193f7fe29b886d7c093f17424fe3de2150a1bfd83386a5dd

(this sample)

NetWire

Executable exe 98af60250a9e0cedaa66f04fe39c412bd0007855255547df68f5da46686c9ced

  
URLhaus
https://urlhaus.abuse.ch/url/365244/
  
Dropping
MD5 cf170a15551e18239a0d412f16bcba2d
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 98af60250a9e0cedaa66f04fe39c412bd0007855255547df68f5da46686c9ced

Comments