MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f13df07fb8d92d3c1acc3b799dbbef6f7a45158bd33c08e74a5f29b0b450965. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0f13df07fb8d92d3c1acc3b799dbbef6f7a45158bd33c08e74a5f29b0b450965
SHA3-384 hash: 1b991ca43887d808571506a9ba71d5143aceb5ef9699abfd20d50fba7d43d2ae6682efdc431761bf0b82d0cc43f34284
SHA1 hash: 4bcd35446346fc248c3a37e0aa31cb813d460f41
MD5 hash: a9b290d91ba6392acbbcf916e27e0b4b
humanhash: whiskey-beer-nevada-nevada
File name:862020,pdf.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:391'841 bytes
First seen:2020-08-06 05:51:37 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:NsMBo970C/0u0cXwrS6kpnvckfhYUqJE/4UyzjTtRPVbcTrGh8XDmteP0wg0xUg:NsEoNr/0u02U5kpvRJYvJjUAjJRCTahm
TLSH D68423C7F6D329577C70AED1E0F7853405711BCAF237A22B6228665EBE0CBC49246AD1
Reporter abuse_ch
Tags:NanoCore RAT zip


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: web72.smartstrategies.gr
Sending IP: 88.99.208.204
From: surendra <surendra@fivestarship.com>
Subject: REMITTANCE USD 7588.50
Attachment: 862020,pdf.zip (contains "862020,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.26176.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0f13df07fb8d92d3c1acc3b799dbbef6f7a45158bd33c08e74a5f29b0b450965/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:53:05 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=b4j56b73rwjnhqnmyo3ztw566332iukyxuz4bdtuuxzjwc2fbfsq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0f13df07fb8d92d3c1acc3b799dbbef6f7a45158bd33c08e74a5f29b0b450965

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip 0f13df07fb8d92d3c1acc3b799dbbef6f7a45158bd33c08e74a5f29b0b450965

(this sample)

NanoCore

Executable exe 3cb221973d52d12fc900f37496a9c5f77b30da63886a0f7d54111982c00e872b

  
Dropping
MD5 c8b0e1ef53206e9a1f8845d379ae6d34
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3cb221973d52d12fc900f37496a9c5f77b30da63886a0f7d54111982c00e872b

Comments