MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b96e53501fd60f307136bd39c20e3f94339e29ea5129241b3d08b324cde0c11a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b96e53501fd60f307136bd39c20e3f94339e29ea5129241b3d08b324cde0c11a
SHA3-384 hash: 08017df9ab8f2552a30b1d30bbda19dddf198b1f42ef8075fa41a4d94114c3f91746cf87fd98e7cc2fe1a12ba393812c
SHA1 hash: 4a92b28cc414889e6b0e4ddc7de67036b65a8c24
MD5 hash: 552996b931ef4c20f2706ae7bcfd39e0
humanhash: carpet-one-cold-glucose
File name:quote-REQUIREMENT-1c-265825-53335PDF.img
Download: download sample
Signature NetWire
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-04 17:24:14 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:JIwpsZ6xrKYpX5e9qIqLvU7ToExkjh6c44bxIIZ+Yjn/W8/tvYExjn6O47sgGOrq:1GeK4XM9WDSTooCW
TLSH E545C6AC722072EFC857D472DEA81C74EA5074BB931F4243A02716EDAA4D897DF644F2
Reporter abuse_ch
Tags:img NetWire RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: jamshrsolutions.com
Sending IP: 209.58.149.67
From: Ravi <ravi@jamshrsolutions.com>
Subject: Enquiry Requirement
Attachment: quote-REQUIREMENT-1c-265825-53335PDF.img (contains "quote-REQUIREMENT-1c-265825-53335PDF.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.33776461.5171.22320.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-05 04:03:26 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
15 of 31 (48.39%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xfxfgua72yhta4jwxu44edr7sqzz4kpkkeusigz5bczsjtpayena._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

img b96e53501fd60f307136bd39c20e3f94339e29ea5129241b3d08b324cde0c11a

(this sample)

NetWire

Executable exe e4bb158234319609a3d891e08f7ae6d6deee7fac7138639a8954dae5f281eea8

  
Dropping
MD5 9988dead8e8276f0909f72da51614387
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e4bb158234319609a3d891e08f7ae6d6deee7fac7138639a8954dae5f281eea8

Comments