MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb3425b4d65c759f023ca22c8d3448944ab290bd5dd4bd2751c4b9b80633147f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb3425b4d65c759f023ca22c8d3448944ab290bd5dd4bd2751c4b9b80633147f
SHA3-384 hash: 9f2b3abdffa7b9c0d206540bfd297f55cceaf477dfe5b090d6008e15ad7c3457819f74c247a546833c3fd7ff34da7875
SHA1 hash: 51ad355975c00a87787561a36ab0b9e63a15590d
MD5 hash: 5e528ae5a6de86a6bc9bdbd53c92c08b
humanhash: autumn-stream-single-skylark
File name:Payment Copies.iso
Download: download sample
Signature NetWire
Create hunting rule
File size:1'245'184 bytes
First seen:2020-10-22 06:55:36 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:ZWqGyTFU66TD/+HG6jBCwmHNV4h9spLyLARG5xSEj53+xLfDcNxaQ2JcDhgNoy5w:ZWqGySN+H/duVPV+ARUQk+D0p2JGSNo
TLSH E6455D6562059F70E47765B10007D0B20212EED32AA1FA5B3EE5BE5BFAB24C60DC5BC7
Reporter abuse_ch
Tags:iso NetWire RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: cp.cloudinc.co.za
Sending IP: 41.66.169.18
From: Shelton Mandipira <info@brandathenaa.co.za>
Subject: Payment
Attachment: Payment Copies.iso (contains "open payment copy.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
134
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb3425b4d65c759f023ca22c8d3448944ab290bd5dd4bd2751c4b9b80633147f/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 01:08:45 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zm2clngwlr2z6ar4uiwi2ncisrflfef5lxkl2j2rys43qbrtcr7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

iso cb3425b4d65c759f023ca22c8d3448944ab290bd5dd4bd2751c4b9b80633147f

(this sample)

NetWire

Executable exe 3b2ea32978b65edcc7308a2860e788b7631ecdde10e72b689268f3fdffdaeb4f

  
Dropping
MD5 73739fdb0582947d75e409af1ffd2fce
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3b2ea32978b65edcc7308a2860e788b7631ecdde10e72b689268f3fdffdaeb4f

Comments