MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b6c944eb502737470183eca23c4766365c9e9fde16aeda42d3f26ffb95ff97b2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b6c944eb502737470183eca23c4766365c9e9fde16aeda42d3f26ffb95ff97b2
SHA3-384 hash: 70d42716477526f5f07ee444dd032179e1d6fb903ea9503eae25a07e528dd4048c1622792126ec3dee83685096a7be3f
SHA1 hash: a45f055722fc926c7c44c9022d2ee7d9ea1b31c9
MD5 hash: 561632c068135fac3c755cd2f921cd09
humanhash: sweet-uniform-oklahoma-wyoming
File name:Our New Order No. 647889026.zip
Download: download sample
Signature NetWire
Create hunting rule
File size:462'613 bytes
First seen:2020-08-13 11:18:51 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:MDo7+7+/s7fn0+xStZDRzytEUbiWLeSPbZM225IjZz1roBWsoqfNq2dleuKhbxTh:it7p7fetVhQEOpeSPqIjns1pZ1Kh9TxX
TLSH 62A42353C0DA66EC2C164E2A534879A62E235EE15D3F7B8722362DC36D427BF34C46C6
Reporter abuse_ch
Tags:NetWire zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: torrespardo.ncloud.es
Sending IP: 185.57.172.23
From: David Zhang <info@nnmed.com>
Subject: RE: AW: Our New Order No. 647889026
Attachment: Our New Order No. 647889026.zip (contains "Our New Order No. 64788926.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
273
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b6c944eb502737470183eca23c4766365c9e9fde16aeda42d3f26ffb95ff97b2/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 11:20:11 UTC
AV detection:
32 of 47 (68.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w3euj22qe43uoamd5srdyr3ggzoj5h66c2xnuqwt6jx7xfp7s6za._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b6c944eb502737470183eca23c4766365c9e9fde16aeda42d3f26ffb95ff97b2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

zip b6c944eb502737470183eca23c4766365c9e9fde16aeda42d3f26ffb95ff97b2

(this sample)

NetWire

Executable exe 5741d60ead4ec57c71e274d23d6a4550650e54edf7613a180de90749a0c651ca

  
Dropping
MD5 9c8caafe400cd27300dadc9680981124
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5741d60ead4ec57c71e274d23d6a4550650e54edf7613a180de90749a0c651ca

Comments