MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd1176d1ac207dbbcef742a55e47cd9fb8b19d8f1e7611d4faa2a80b54b2fb70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd1176d1ac207dbbcef742a55e47cd9fb8b19d8f1e7611d4faa2a80b54b2fb70
SHA3-384 hash: 17e3b27e2bcd86c17844101f46de08048a9acc0eeec483249e3ec86d81525f3f7e5c558e28a1f1fc6171be0689b1353e
SHA1 hash: 667cb09e6fd9fbb6d3415c26fd1ff830cbdbdc47
MD5 hash: 987ffe977f005f63deecdba5e9709bf1
humanhash: carolina-muppet-queen-music
File name:lettera di pagamento 29-07-2020.uue
Download: download sample
Signature NetWire
Create hunting rule
File size:590'542 bytes
First seen:2020-07-29 11:54:59 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 12288:+jzmoGha6qd1t3cA4vCoBvqiMQul0KPqFDLRO5LqhvAN9:CmoWaVd1FcFvCoZqi5eYXRYLqhvAN9
TLSH 62C4233289F623AFAA552EA18FBDEE79F841710C07199907BCED1A6593048674F2C71C
Reporter abuse_ch
Tags:geo ITA NetWire RAT t-online UBI UBIBanca uue


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: mailout02.t-online.de
Sending IP: 194.25.134.17
From: Servizio Clienti UBI Banca <fa.zajitschek@t-online.de>
Reply-To: jsntfxqvip.163@gmail.com <jsntfxqvip.163@gmail.com>
Subject: Qui UBI Ordine di pagamento bollettino postale Prefabbricati SCS
Attachment: lettera di pagamento 29-07-2020.uue (contains "lettera di pagamento 29-07-2020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
293
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd1176d1ac207dbbcef742a55e47cd9fb8b19d8f1e7611d4faa2a80b54b2fb70/
Threat name:
Win32.Trojan.DataStealer
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 11:56:06 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3uixnunmeb63xtxxiksv4r6nt64ldhmpdz3bdvh2ukuawvfs7nya._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Barys
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dd1176d1ac207dbbcef742a55e47cd9fb8b19d8f1e7611d4faa2a80b54b2fb70

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

uue dd1176d1ac207dbbcef742a55e47cd9fb8b19d8f1e7611d4faa2a80b54b2fb70

(this sample)

NetWire

Executable exe f5041ea07d530c171a670d71769deb2185c8620462b4e26c59a923784f3bd17a

  
Dropping
MD5 2013298bbd1a4bf0bd41d04ad192be62
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f5041ea07d530c171a670d71769deb2185c8620462b4e26c59a923784f3bd17a

Comments