MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db6722df4057c66c0ecad864f0d34b96e4eeb82f2b4bbc383a808ad4cdebfda8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db6722df4057c66c0ecad864f0d34b96e4eeb82f2b4bbc383a808ad4cdebfda8
SHA3-384 hash: 0d3741c81c2d7fd0e0045a167155fc98e6afeb03c17e20ae535fd5cc9f07051588bf83d5eceaa37f7fdbaee2dbaadbcf
SHA1 hash: ac6a4064aca18e83070b626c143e0592473c6d5c
MD5 hash: 92768148c44e8e4f8962c2d531b9f696
humanhash: yankee-massachusetts-lima-nebraska
File name:cnf3669009.uue
Download: download sample
Signature NetWire
Create hunting rule
File size:619'025 bytes
First seen:2020-08-05 11:52:25 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 12288:JssFLTrh0zYwDwC/WXIgYFJ1jD12cSvdAtoagX9:JNyGCucD1HSFA2tX9
TLSH D5D423B6C32C54F2E80245A07949CB314DBF4FDE4D4CBFA258577CBE29A889A52940B7
Reporter abuse_ch
Tags:Caixa NetWire RAT t-online uue


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: mailout08.t-online.de
Sending IP: 194.25.134.20
From: Buzón UAFE <fa.zajitschek@t-online.de>
Reply-To: Buzón UAFE <fa.zajitschek@t-online.de>
Subject: Caixa Confirming facturas TOTANA TSC INGINERA S L.
Attachment: cnf3669009.uue (contains "cnf3669009.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
312
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/db6722df4057c66c0ecad864f0d34b96e4eeb82f2b4bbc383a808ad4cdebfda8/
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 11:54:07 UTC
AV detection:
17 of 29 (58.62%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ntsfx2ak7dgydwk3bspbu2ls3so5obpfnf3yob2qcfnjtpl7wua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/db6722df4057c66c0ecad864f0d34b96e4eeb82f2b4bbc383a808ad4cdebfda8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

uue db6722df4057c66c0ecad864f0d34b96e4eeb82f2b4bbc383a808ad4cdebfda8

(this sample)

NetWire

Executable exe b5f9a952c4009061a21147103fc6d762c60e070fc588cab92846fc1c29679715

  
Dropping
MD5 f13aa37174903d14951c141da29ec4bc
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b5f9a952c4009061a21147103fc6d762c60e070fc588cab92846fc1c29679715

Comments