MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40d102fc7728819872c946f135cde399e0174d2f2e017e569d346ce7eedf544a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40d102fc7728819872c946f135cde399e0174d2f2e017e569d346ce7eedf544a
SHA3-384 hash: 2ae0dfaadbd7c8300497c0ce7aa2a993b25fb23332c2d5669eeb19791f8109c7b57b96a7f7797c1f024604db1f84a696
SHA1 hash: 5a9a3a7c5395bfa01332b285c1ae9db1737c004d
MD5 hash: cd5960cb5a4761d620944af415685d4d
humanhash: cold-missouri-montana-august
File name:Document.iso
Download: download sample
Signature NanoCore
Create hunting rule
File size:395'264 bytes
First seen:2020-04-29 16:34:43 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:u6q4zY5YYTmO2x8hWKuUN/N3mciAy3GPOIXyKBAWiTYdZLky8wHr/+CJzeJfZ:PO2x8D/NVTO+lb6YvLT6IiJ
TLSH AC8402B853D9637FC099037994839E06B2A3815AE0B7F7663D9E5E5E178FBC12910383
Reporter abuse_ch
Tags:iso NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: dharmajaya.co.id
Sending IP: 103.113.170.147
From: Singapore Post <delivery.notice@singpost.com>
Subject: Your Singapore Post package arrived at our office
Attachment: Document.iso (contains "Document.exe")

NanoCore RAT C2:
172.111.188.199:8829

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.GenKryptik.EJLK.31415.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 14:04:33 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
17 of 31 (54.84%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=idiqf7dxfcazq4wji3ytltpdthqbotjpfyax4vu5grwop3w7krfa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

iso 40d102fc7728819872c946f135cde399e0174d2f2e017e569d346ce7eedf544a

(this sample)

NanoCore

Executable exe d83d25cdeec57d8bdb0ae70c21d60f32645a2fa21f3f7792774b5ad3bffce9b5

  
Dropping
MD5 da9112d50e0f40e54d8bba677416c0e3
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d83d25cdeec57d8bdb0ae70c21d60f32645a2fa21f3f7792774b5ad3bffce9b5

Comments