MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da39b46eceeb9f0837da42119c575533611a37b32419aeb4c8a0eeadd880f6c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da39b46eceeb9f0837da42119c575533611a37b32419aeb4c8a0eeadd880f6c2
SHA3-384 hash: f52e6af9e8b9bc26cf4fd2f552a105f1e7a899901dad56204275a82bcced413fb95614c3dc8bc5c489c2d41f84a4a97b
SHA1 hash: a8582be7eedc660fe1eb03df773366be94b2710e
MD5 hash: c1274bd3d34d2f6e5198d93f9d8781e5
humanhash: minnesota-beer-table-five
File name:SKBMT_ 5870Z904_ Image.img
Download: download sample
Signature NetWire
Create hunting rule
File size:1'245'184 bytes
First seen:2021-02-23 07:26:49 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:lxE3WpQMV/0tfoXvXAa5EQJJfFSa8BLkCvDOiiAhKGaxCvX5poSZoWeaATxU3RUh:nFQMG6fwkDBSFBFO3/x+pZoxt1C
TLSH 5545127CC621C861FB754ABE892A1A893226FF6635D46384F8CD0317C773B782956DC8
Reporter abuse_ch
Tags:img NetWire RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: servidor2.mediosenred.tv
Sending IP: 5.145.175.121
From: Philipp Baminger <philippe.li@midea.com>
Subject: RV: AW: Payment confirmation
Attachment: SKBMT_ 5870Z904_ Image.img (contains "SKBMT_ 5870Z904_ Image.exe")

NetWire RAT C2:
mmakopl.duckdns.org:5569

Intelligence

File Origin
# of uploads :
1
# of downloads :
263
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da39b46eceeb9f0837da42119c575533611a37b32419aeb4c8a0eeadd880f6c2/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 07:27:17 UTC
AV detection:
12 of 48 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3i43i3wo5opqqn62iiizyv2vgnqrun5teqm25ngiudxk3wea63ba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/da39b46eceeb9f0837da42119c575533611a37b32419aeb4c8a0eeadd880f6c2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

img da39b46eceeb9f0837da42119c575533611a37b32419aeb4c8a0eeadd880f6c2

(this sample)

NetWire

Executable exe 2e5fa5d3014a67a660612edaddf0e5abf60d7b0f8b82336b17ab6464c4567d03

  
Dropping
MD5 d7e428d65ccdfae4250a05f8c07dd391
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2e5fa5d3014a67a660612edaddf0e5abf60d7b0f8b82336b17ab6464c4567d03

Comments