MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efbdd19d4daedfae66e2e249acc960dda45cd56bacce785f48dbe62aee4e5186. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: efbdd19d4daedfae66e2e249acc960dda45cd56bacce785f48dbe62aee4e5186
SHA3-384 hash: 8429b3dd5aac4e6d5e80826a8dc33723974b537f4290b9ba0f4ff1ec5eeee31027e32376bc867518eb7ad066994b48f2
SHA1 hash: 8abccd0ee57b6f3d5cbb097066cd5e3446953cf6
MD5 hash: 575d745dbd25ad7d843655d0ded0ea83
humanhash: mirror-winter-alaska-cola
File name:PAYMENT NOTIFICATION.UUE
Download: download sample
Signature NetWire
Create hunting rule
File size:897'476 bytes
First seen:2020-06-09 05:42:56 UTC
Last seen:Never
File type:unknown
MIME type:application/vnd.ms-cab-compressed
ssdeep 24576:Xm9vvaLdQpiG9Sru2NOZsXGf8TteSPMNuxqvMs1Y18x9Keq:Xm9vvIQptO5NOsXGfceS0NuUvl1Q8qH
TLSH 721533852389BEF9DBEB7F3D06A7814F6CA3E141486CDB2E35719AD3C90449971324A3
Reporter abuse_ch
Tags:NetWire RAT uue


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: server.jcweb.co.za
Sending IP: 164.160.89.119
From: Capitecbank.co.za <capitec@email.co.za>
Reply-To: no-reply@capitec.co.za
Subject: Payment Notification from AM SYSTEMS INTEGRATIONS_8GB5SKLG
Attachment: PAYMENT NOTIFICATION.UUE (contains "PAYMENT NOTIFICATION.exe")

NetWire RAT C2:
154.16.93.177:3365

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-09 05:44:05 UTC
AV detection:
21 of 31 (67.74%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5665dhknv3p24zxc4je2zsla3wsfzvllvthhqx2i3ptcv3sokgda._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

unknown efbdd19d4daedfae66e2e249acc960dda45cd56bacce785f48dbe62aee4e5186

(this sample)

NetWire

Executable exe 9eb4147d9fa5bdb1ad291e70ba7ff90fd005c2aa21ceaf4af8effbebc5cf4621

  
Dropping
MD5 48f2dd0cfdd0ff30ca7af9f48422d9a5
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9eb4147d9fa5bdb1ad291e70ba7ff90fd005c2aa21ceaf4af8effbebc5cf4621

Comments