MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3b6572d8673ae805fb928f98ec9b641370847593132d9d34227f8ddd16d96ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e3b6572d8673ae805fb928f98ec9b641370847593132d9d34227f8ddd16d96ad
SHA3-384 hash: 88e7b8da1673da0e0502d71053dc2911d3730222706a95e888cb803ab60f0eaaf3e7347dc389ed01e64cd7fe5423c138
SHA1 hash: 0cb123d293c8c5b959b2596a55655691fcca7a59
MD5 hash: 81676f5d226c8d7e27eb7b2385285f97
humanhash: white-may-cola-sink
File name:91HN20DCI100053,54,80.zip
Download: download sample
Signature NetWire
Create hunting rule
File size:478'127 bytes
First seen:2020-10-26 14:01:28 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:RnbjFcqj/DPj34XAs8XzcG+tfuk16LWIY0s05bF4gaPBJk29Npili6IJ:RbjFcEDPj3UX8XzcGcd8Wij9m5PBXYl+
TLSH 1CA423B2680E5E17483FAF0CCC4B6881FEF597C6CAA7938E568974240D7AFD60634964
Reporter abuse_ch
Tags:NetWire zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: mail.eww-group.com
Sending IP: 111.90.146.99
From: Purchasing Department <purchase.samples@libgroup.co.th>
Reply-To: karensdwind@null.net
Subject: PO. 91HN20DCI100053,54,80 Order Nike Season SU21 MID NOV BUY.
Attachment: 91HN20DCI100053,54,80.zip (contains "91HN20DCI100053,54,80.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e3b6572d8673ae805fb928f98ec9b641370847593132d9d34227f8ddd16d96ad/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-26 05:36:51 UTC
AV detection:
7 of 47 (14.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4o3folmgooxiax5zfd4y5snwie3qqr2zgezntu2ce74n3ulns2wq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

zip e3b6572d8673ae805fb928f98ec9b641370847593132d9d34227f8ddd16d96ad

(this sample)

NetWire

Executable exe 49551fe3b312425f0a4f946b3a6eb9044bc7b2b7b1665288153295677384509e

  
Dropping
MD5 dc94775bedb105ddf0c39bb4cf2d5340
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 49551fe3b312425f0a4f946b3a6eb9044bc7b2b7b1665288153295677384509e

Comments