MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bafcc766822387e557ea05e8705c82a65fddcafdb96a30a22cca817aec218913. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bafcc766822387e557ea05e8705c82a65fddcafdb96a30a22cca817aec218913
SHA3-384 hash: 2488d5e1bdc267794757915a8712a61f098004e7e3a51cd5860d971a2f9cab2329eb99780d2bf82e196c8f1eb21360f8
SHA1 hash: 94592262b35c6f366fb72559525e606cad71304e
MD5 hash: 161481de943f3a5113b8467e49d78ddd
humanhash: ceiling-hamper-white-florida
File name:Payment Confirmation_PDF.img
Download: download sample
Signature NetWire
Create hunting rule
File size:3'932'160 bytes
First seen:2020-08-13 10:53:21 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 49152:/aNF194GeuRJJmna6X2KEbJkX/le+jyGiGsxdlDK:/aNF194GeuRJJmnHX2FSX/DjyGiVrO
TLSH F4066D26BC43728BF94604F00ED6D5E4B1EE352902B05A38AD93592EF90DE573CCE9B5
Reporter abuse_ch
Tags:img NetWire nVpn RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: slot0.elsevvedysteel.com
Sending IP: 45.95.170.146
From: kumar Sharad <info@elsevvedysteel.com>
Reply-To: kumar Sharad <reply@hkcostarn.com>
Subject: Payment confirmation to infoadmin@yuewen.com.cn
Attachment: Payment Confirmation_PDF.img (contains "Payment Confirmation_PDF.exe")

NetWire RAT C2:
alkaline.publicvm.com:1777 (198.23.213.38)

Intelligence

File Origin
# of uploads :
1
# of downloads :
280
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.d895d1a443969940.25635.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bafcc766822387e557ea05e8705c82a65fddcafdb96a30a22cca817aec218913/
Threat name:
ByteCode-MSIL.Backdoor.NetWiredRc
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 10:55:07 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xl6mozuceod6kv7kaxuhaxecuzp53sx5xfvdbirmzkaxv3bbrejq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/bafcc766822387e557ea05e8705c82a65fddcafdb96a30a22cca817aec218913

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

img bafcc766822387e557ea05e8705c82a65fddcafdb96a30a22cca817aec218913

(this sample)

NetWire

Executable exe 07f411bd02cb5654c8903477700a32802c0ed1f445d14144bc306a2af3aa7910

  
Dropping
MD5 d895d1a443969940fb0386bf4202a5c6
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 07f411bd02cb5654c8903477700a32802c0ed1f445d14144bc306a2af3aa7910

Comments