MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 faf18446068636ea7d1561b71926e025d58c0da26e756c236b1dea57296212b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NetWire


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: faf18446068636ea7d1561b71926e025d58c0da26e756c236b1dea57296212b1
SHA3-384 hash: 6428d931df83ae8c4d332d2f5c0ef84f1f0e806c4a75b0e158fddbea28174600b98d90168810fd64585138ce5783a773
SHA1 hash: 65ef5ca6a60684e8984206ab706bb4be1283e8e9
MD5 hash: e3415c82faa429d3a33378ff249252c2
humanhash: muppet-fillet-ohio-cat
File name:Proof of Payment.iso
Download: download sample
Signature NetWire
Create hunting rule
File size:1'572'864 bytes
First seen:2020-10-05 11:53:19 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:9AOcZyptB1BaFbgxTHAZ2+xt2eEqBsAcNeVrvjnC6B:Hj3a1guZNxt2aLcNyuS
TLSH 68751202BBC188B2E4731931A935A7146E7D7D201F25DB2FF3DC5A6EAB35140A6247B3
Reporter abuse_ch
Tags:iso NetWire RAT


Avatar
abuse_ch
Malspam distributing NetWire:

HELO: mail.genoson.gq
Sending IP: 45.147.162.213
From: Jason Bourne <admin@genoson.gq>
Subject: forward Proof of payment
Attachment: Proof of Payment.iso (contains "Proof of Payment.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/faf18446068636ea7d1561b71926e025d58c0da26e756c236b1dea57296212b1/
Threat name:
Win32.Trojan.Bluteal
Create hunting rule
Status:
Malicious
First seen:
2020-10-05 08:43:35 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7lyyirqgqy3ou7ivmg3rsjxaexkyydncnz2wyi3ldxvfoklcckyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Nanocore
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/faf18446068636ea7d1561b71926e025d58c0da26e756c236b1dea57296212b1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NetWire

iso faf18446068636ea7d1561b71926e025d58c0da26e756c236b1dea57296212b1

(this sample)

NetWire

Executable exe dc8b1aa91228f69edb8b71fafd9231f6d6d55d50ea17e3a845a3014e419cdb60

  
Dropping
MD5 d29a1c53858cbb0321e2a941d0672985
  
Dropping
NetWire
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dc8b1aa91228f69edb8b71fafd9231f6d6d55d50ea17e3a845a3014e419cdb60

Comments