MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c8b082fe3e966bc82a74debb381450d715f86c395378c1e888fd3c535a1ecdbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c8b082fe3e966bc82a74debb381450d715f86c395378c1e888fd3c535a1ecdbc
SHA3-384 hash: f1235b785c063330005c66da866d2db92d8cd17f26ff3bb512914a09b6ad1399c2f591d017032f073e21cab48ad9e2e2
SHA1 hash: be5114f587a049b439905cd9d0208f934251c850
MD5 hash: 010b80568603eac6032961405d630162
humanhash: avocado-mockingbird-robert-dakota
File name:PURCHASE_FABRICS_APPAREL_100% COOTON.rar
Download: download sample
Signature NetWire
Create hunting rule
File size:362'983 bytes
First seen:2020-10-21 08:56:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:zzSzzWDl1PCJXQ+jmOALcmbEkO4AKsZ7MO+KnPJgK/aW6qeR8wuk5g8BAKmIkwZP:fUqaj/2cM5A//PDzOu2BXxvys
TLSH 2974238D4C2EE849892CC1B4B06E181873AF5E91BB8DA8BFFB515C7BF3738605D85581
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: shamirlensthailand.com
Sending IP: 103.7.56.165
From: Vertex Win Apparel Sourcing <moinul@vertexwin.com>
Subject: HF-LOYAL-201009A-- 100% Cotton Yarn P/O for Kohl's St.Eve 2/25x (Fashion Order); PO# 4035656 - 4035671 (REF# 22-20-57-HU-20
Attachment: PURCHASE_FABRICS_APPAREL_100% COOTON.rar (contains "PURCHASE_FABRICS_APPAREL_100%_COOTON.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c8b082fe3e966bc82a74debb381450d715f86c395378c1e888fd3c535a1ecdbc/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-21 08:20:10 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zcyif7r6szv4qktu325tqfcq24k7q3bzkn4md2ei7u6fgwq6zw6a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

rar c8b082fe3e966bc82a74debb381450d715f86c395378c1e888fd3c535a1ecdbc

(this sample)

NetWire

Executable exe e6c265d43fd926038d77f0caf1773f93c5d684fb2fce4af1f4474982eb494762

  
Dropping
MD5 69a2604dc3860929c8794dd92e89b481
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e6c265d43fd926038d77f0caf1773f93c5d684fb2fce4af1f4474982eb494762

Comments