MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2cf3893a66e3b26e7b84d30a9ad2a30e4a0d45555035e50cb90df7db0fe3d5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d2cf3893a66e3b26e7b84d30a9ad2a30e4a0d45555035e50cb90df7db0fe3d5b
SHA3-384 hash: 526412301e59164f8d95d59d7a756c94919e9e1de61d19700084bf8d23877e2f378352af8fb0315e879caa2f2a36bdc4
SHA1 hash: bf953326958634cdecbc4bdd435170605d3206a3
MD5 hash: 4e60d6a058b2452efedab5c5c9ca19c7
humanhash: india-eighteen-nitrogen-speaker
File name:RFQ BONATTI 12.08.2020.zip
Download: download sample
Signature NetWire
Create hunting rule
File size:445'806 bytes
First seen:2020-08-13 11:10:30 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:iWujfLW/TjHumwCwJ68LH0eDZzb7xL4AHnKfwRvT:iWu7LMTjhwH7LH0qZv7DHKIRb
TLSH 6E9423989CC6606D7B8B8E996CB79110B0AA807FDF9377A21CD64E273C98E507CD5488
Reporter abuse_ch
Tags:NetWire zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: smtp.kosmoindustries.com
Sending IP: 23.231.65.32
From: Bonatti International Company <order@kosmoindustries.com>
Reply-To: Bonatti International Company <logspass007@gmail.com>
Subject: RFQ BONATTI 18000229 IQ1201 WO 210000102767
Attachment: RFQ BONATTI 12.08.2020.zip (contains "RFQ BONATTI 18000229 IQ1201 WO 210000102767.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
268
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d2cf3893a66e3b26e7b84d30a9ad2a30e4a0d45555035e50cb90df7db0fe3d5b/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 11:12:09 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2lhtre5gny5snz5yjuyktljkgdskbvcvkubv4uglsdpx3mh6hvnq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Lokibot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d2cf3893a66e3b26e7b84d30a9ad2a30e4a0d45555035e50cb90df7db0fe3d5b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

zip d2cf3893a66e3b26e7b84d30a9ad2a30e4a0d45555035e50cb90df7db0fe3d5b

(this sample)

NetWire

Executable exe 5b3cc30719578d96ef64e9341e00eedb05512ee9692b2eff924aabc54e7a16e4

  
Dropping
MD5 a5d908a447a9bf00dd0ef8750a00721e
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5b3cc30719578d96ef64e9341e00eedb05512ee9692b2eff924aabc54e7a16e4

Comments