MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d937f56683ae1b3b9b8a20e73cdf783b05af1ff08bf53695d91fb9c8de6b7d49. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d937f56683ae1b3b9b8a20e73cdf783b05af1ff08bf53695d91fb9c8de6b7d49
SHA3-384 hash: cae9cc3fd09aa14f28ccfffcf6e09af68e23fcad2310192926adc200cd2ab162451858e20d0b609e0c752008dd90d06f
SHA1 hash: f9d3fa39cd6e9f3d56997b8005981dc3cef80df9
MD5 hash: 6235680c85c26bcae4b63f9d2938088e
humanhash: kentucky-lamp-neptune-early
File name:Payment notification.cab
Download: download sample
Signature NetWire
Create hunting rule
File size:830'157 bytes
First seen:2020-06-25 09:21:03 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 12288:e5pNSYvWCaLNA+V04j5lDimCPD9rYWWtpDgLYinjrtuXw4iU5xZCa99nozirz:0H9vvaLdV049lC+UYantGwCCMBdz
TLSH 1F0533E1A0A4CBB0FECBF97A034042A227DEB510D460BE70ED7B4599194D17653BB27E
Reporter abuse_ch
Tags:cab NetWire RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: paulshomemade.dedicated.co.za
Sending IP: 154.0.169.175
From: Notification@nedbank.co.za
Reply-To: No-repIy@nedbank.co.za
Subject: Payment Notification
Attachment: Payment notification.cab (contains "Payment notification.exe")

NetWire RAT C2:
154.16.93.182:3376

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Downloader.Aiis-6803892-0
Create hunting rule

SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d937f56683ae1b3b9b8a20e73cdf783b05af1ff08bf53695d91fb9c8de6b7d49/
Gathering data
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3e37kzudvyntxg4kedttzx3yhmc26h7qrp2tnfozd644rxtlpveq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

cab d937f56683ae1b3b9b8a20e73cdf783b05af1ff08bf53695d91fb9c8de6b7d49

(this sample)

NetWire

Executable exe 39a0ad9117de868c1aa3f891c58e750ef8688b829582c08c4c39098b94bf4f9c

  
Dropping
MD5 93d1e640296edaa56876e4e16b4f9069
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 39a0ad9117de868c1aa3f891c58e750ef8688b829582c08c4c39098b94bf4f9c

Comments