MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35027f1bd4719815df11a445adc85d0635f1c4ecbc17abed1046890864d2c56d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35027f1bd4719815df11a445adc85d0635f1c4ecbc17abed1046890864d2c56d
SHA3-384 hash: c003505234edf254e26256e1bbdc042039c829d6cf01533073995948fe1337e17b58219936f6d33adeefb20547e35c8a
SHA1 hash: 50b7898cd0e63773720c46bb7b52d5fdf7e3f8b4
MD5 hash: 46998fbe630fe52152bee67464ae5676
humanhash: lithium-bakerloo-alabama-sixteen
File name:Transfer slip.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:426'141 bytes
First seen:2020-08-06 05:54:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:tUR+SgpKzPBOHgBy1ulmGzG4rsasNU+A7+8x2R2fLpcpi:ORF7YHgBAu4GzG4rsB67+8eqcc
TLSH 6994232F03506C956B9DF114C668433CB4EF921EEB3B1CE97662F4A7609F192FE91488
Reporter abuse_ch
Tags:NanoCore RAT zip


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: scmt.gov.iq
Sending IP: 37.48.85.227
From: insurance <insurance@scmt.gov.iq>
Subject: Payment Transfer slip
Attachment: Transfer slip.zip (contains "Transfer slip.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/35027f1bd4719815df11a445adc85d0635f1c4ecbc17abed1046890864d2c56d/
Threat name:
ByteCode-MSIL.Trojan.SmartAssembly
Create hunting rule
Status:
Malicious
First seen:
2020-08-06 05:56:08 UTC
AV detection:
20 of 28 (71.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gubh6g6uogmblxyrurc23sc5ay27drhmxql2x3iqi2eqqzgsyvwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/35027f1bd4719815df11a445adc85d0635f1c4ecbc17abed1046890864d2c56d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip 35027f1bd4719815df11a445adc85d0635f1c4ecbc17abed1046890864d2c56d

(this sample)

NanoCore

Executable exe c24b19343162f2b4af07548396a889ff6d6188f263f549677ca423cbd89d0107

  
Dropping
MD5 6541da5a3a5be6cf45a7c0851c4cdc75
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c24b19343162f2b4af07548396a889ff6d6188f263f549677ca423cbd89d0107

Comments