MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2f7884c85f66ce15f8df27016c1eb2e3d27370f77bc443e8df964c155a63677. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2f7884c85f66ce15f8df27016c1eb2e3d27370f77bc443e8df964c155a63677
SHA3-384 hash: 29f696c4f3f9d928ae42796dae9c1f6c30f079606b8de0d4c9dd613ff48a81c58b0d9d52936989399053b838a2e2cb83
SHA1 hash: 0a584de67b35ac79f47e71cd563ee3bcf5542142
MD5 hash: cfebabd96a12be964c6c51049d8db989
humanhash: magazine-fanta-moon-india
File name:FedEx Shipment.img
Download: download sample
Signature NetWire
Create hunting rule
File size:1'310'720 bytes
First seen:2021-03-05 07:16:27 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:95g3ZRp9hYYNq6z/U+HZ5RzDiN7gv+UuQnTi+5vcmx+qywcnHG7Q/+hGZcS:z0ZRp9Rq6z/7XWN5UuQbvc7G8/+hGZ5
TLSH F555F2C8B34035EEC929FE715B6A6DB067633CFADA123503601F722D8E7E2528921CD5
Reporter abuse_ch
Tags:FedEx img NetWire RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: vps38947.servconfig.com
Sending IP: 144.208.66.19
From: FedEx <rvfwd@avalonjobs.net>
Subject: Your Parcel Delivery
Attachment: FedEx Shipment.img (contains "FedEx Shipment.exe")

NetWire RAT C2:
severdops.ddns.net:7390

Intelligence

File Origin
# of uploads :
1
# of downloads :
370
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Artemis20E5BE824638.30848.17776.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b2f7884c85f66ce15f8df27016c1eb2e3d27370f77bc443e8df964c155a63677/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-03-05 01:10:20 UTC
AV detection:
11 of 46 (23.91%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wl3yqtef6zwocx4n6jybnqplfy6sonypo66eipun7fsmcvnggz3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b2f7884c85f66ce15f8df27016c1eb2e3d27370f77bc443e8df964c155a63677

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

img b2f7884c85f66ce15f8df27016c1eb2e3d27370f77bc443e8df964c155a63677

(this sample)

NetWire

Executable exe cef2f777b4c29a5ced187382e3c0a0ee61d4c71471fc5d100b78a4e88f4324de

  
Dropping
MD5 20e5be824638df2b4f86520d5a5a0cad
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cef2f777b4c29a5ced187382e3c0a0ee61d4c71471fc5d100b78a4e88f4324de

Comments