MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c013e402286e5fccbbe36f14d8ab5af19ef3eae655d1c8c54f9552c589256e22. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c013e402286e5fccbbe36f14d8ab5af19ef3eae655d1c8c54f9552c589256e22
SHA3-384 hash: 88483b7c789f9d5226efe3f55b69b2206f375032194dc739ed4327ded37d43d831c3e70ddd79848ec54a3b067d3663e9
SHA1 hash: 3449f191321b08f65a535a559e6a69c68bca7b2a
MD5 hash: ae3276d85a84f333c0ee81f1c8aa187c
humanhash: timing-xray-uranus-pasta
File name:Proof of Payment.img
Download: download sample
Signature NetWire
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-05 07:03:39 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:GJ2wtEGI4ES/RICG6B+rD4lh5ZT9WDsxNu:GJ2hG1ES/RICGTr8zbMYxN
TLSH EB45E12076A80B19D8FAA7F65934D11447B63E853273E39D5DDA31CD2A72F004B32A6F
Reporter cocaman
Tags:img NetWire


Avatar
cocaman
Malicious email (T1566.001)
From: "Jason Bourne <admin@genoson.cf>"
Received: "from mail.genoson.cf (unknown [45.147.162.237]) "
Date: "Mon, 05 Oct 2020 18:10:47 +1200"
Subject: "Proof of Payment"
Attachment: "Proof of Payment.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c013e402286e5fccbbe36f14d8ab5af19ef3eae655d1c8c54f9552c589256e22/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-10-05 06:21:40 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yaj6iarinzp4zo7dn4knrk226gpph2xgkxi4rrkpsvjmlcjfnyra._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
AgentTesla
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c013e402286e5fccbbe36f14d8ab5af19ef3eae655d1c8c54f9552c589256e22

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

img c013e402286e5fccbbe36f14d8ab5af19ef3eae655d1c8c54f9552c589256e22

(this sample)

NetWire

Executable exe 880a3f89941849fc46d6921a4ef7326e4b2b074a505e916cac0eb1cd0f15c45f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 880a3f89941849fc46d6921a4ef7326e4b2b074a505e916cac0eb1cd0f15c45f

Comments