MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 060879424d5c5232887919354e8ede285168c6bda0b2545970b76918d0b3f198. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 060879424d5c5232887919354e8ede285168c6bda0b2545970b76918d0b3f198
SHA3-384 hash: 8b96ff2a4ce79c67e3de5f840315d4d72bfc1b27e032ac1e4060a942b84d46731e5cef6e8798b7155a556ac6eee5ba8f
SHA1 hash: 8f72f6fed49ee84944b64b7a1b830869311449f3
MD5 hash: e67293ce3a2cd2e1ec8845c4464b0c3a
humanhash: fillet-venus-high-romeo
File name:Receipt.img
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'245'184 bytes
First seen:2020-07-23 18:49:45 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:8sDjUDw7Bf64wSaaSXofvR4Lfb7uykwzVzULijGaG1GGGsuGGGGGGGJGGsnNNNNn:/jvVYa5nRWfb7uykwzV
TLSH 5D458D56CB7A4AFAEB9007BCE450D10942B8A42F63D5D3852F9BFDF4B0AE5241B03D52
Reporter cocaman
Tags:img NanoCore


Avatar
cocaman
Malicious email
From: Accounts <billacceptance@payment.com>
Received: from comworks.servercontrol.com.au (comworks.servercontrol.com.au [27.50.88.49])
Date: Thu, 23 Jul 2020 10:15:45 -0700
Subject: Thank you for your payment!
Attachment: Receipt.img

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/060879424d5c5232887919354e8ede285168c6bda0b2545970b76918d0b3f198/
Threat name:
ByteCode-MSIL.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-23 18:51:04 UTC
File Type:
Binary (Archive)
Extracted files:
20
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ayehsqsnlrjdfcdzde2u5dw6fbiwrrv5uczfiwlqw5urruft6gma._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/060879424d5c5232887919354e8ede285168c6bda0b2545970b76918d0b3f198

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

img 060879424d5c5232887919354e8ede285168c6bda0b2545970b76918d0b3f198

(this sample)

NanoCore

Executable exe d51f21ff25f795d8e35ceee54a3e2e46183f46eee6ba3f9fe2cf94893ef6bc63

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d51f21ff25f795d8e35ceee54a3e2e46183f46eee6ba3f9fe2cf94893ef6bc63
  
Dropping
NanoCore

Comments