MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc80da42d0a79006379f0ceb6cba541293f0343f2fe82159ea4c794acfecfe3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc80da42d0a79006379f0ceb6cba541293f0343f2fe82159ea4c794acfecfe3b
SHA3-384 hash: 33aaa64282880f6d28b0f5313bc7cba78df689e14c85c8ac6cb9f1874b7942cd6b9af75f3cc61ad985071443660355ba
SHA1 hash: fe2d8e74c165e420d910843068df10f749bdaa98
MD5 hash: 26e704da6e0d3e7c37c765aba4bddcde
humanhash: double-three-sweet-kitten
File name:Proof_of _Payment.img
Download: download sample
Signature NetWire
Create hunting rule
File size:1'507'328 bytes
First seen:2020-10-19 07:23:28 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:08B5yMQNt1rRpOa23BKQ1lP9CLf7G9A1GKZHNYPzodGT/P:ixrRcLsiPIfOA1GUKzodGT/
TLSH A665691423F80B19F47B97F1962850418BB67A9A553ED24C7DCD31EE9FB2B010A63B27
Reporter abuse_ch
Tags:geo img NedBank NetWire RAT ZAF


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: mail.genoxyl.ga
Sending IP: 168.235.67.97
From: NedBank <Notification@nedbank.co.za>
Reply-To: Notification@nedbank.co.za
Subject: Payment Notification
Attachment: Proof_of _Payment.img (contains "Proof_of _Payment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.14.6524.21044.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc80da42d0a79006379f0ceb6cba541293f0343f2fe82159ea4c794acfecfe3b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 03:50:43 UTC
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zsanuqwqu6iamn47btvwzosuckj7anb7f7uccwpkjr4uvt7m7y5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cc80da42d0a79006379f0ceb6cba541293f0343f2fe82159ea4c794acfecfe3b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

img cc80da42d0a79006379f0ceb6cba541293f0343f2fe82159ea4c794acfecfe3b

(this sample)

NetWire

Executable exe a6f68b61781c4503ac6dbc6b79d22d3a2f6e7995c35e85f08c0d153e056d6f0e

  
Dropping
MD5 e969f65aaed47276c22e8d5a85d09ca1
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a6f68b61781c4503ac6dbc6b79d22d3a2f6e7995c35e85f08c0d153e056d6f0e

Comments