MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 522fde42f4d1698a1043b0d7b66491bb7cd9eb4a45b344c5af5cd4ef515c7387. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 522fde42f4d1698a1043b0d7b66491bb7cd9eb4a45b344c5af5cd4ef515c7387
SHA3-384 hash: 03863d99fad7ac9f65017533d364bdfd09b032a59e5e9900cc82167d61803e167aeb2e9b1b4b51018e4bee439984689e
SHA1 hash: e3a073acce4c9284a7d93a24d23d40b1527aa24c
MD5 hash: cce5d0ff9d497af3572f63943353f89e
humanhash: coffee-social-kitten-delaware
File name:DHL SHIPMENT NOTIFICATION_PDF.ace
Download: download sample
Signature NanoCore
Create hunting rule
File size:336'661 bytes
First seen:2020-04-29 07:40:39 UTC
Last seen:Never
File type: ace
MIME type:application/x-rar
ssdeep 6144:XUVijTyphvwZOk0eL8ocPx9UHHR1TsKf41cafuozQR29O0fdQ+qk+ARMyN7VdY68:Xd23IZL0eghLUHHDTZAcW9zxv9N78QU
TLSH 59642395E78F4375CE33F8046C7B3A5CB256A844E025BA2EC40811627E5AD4D3DC6BDE
Reporter cocaman
Tags:ace NanoCore


Avatar
cocaman
Malicious email
From: DHL EXPRESS <NoReply.ODD@dhl.com>
Received: from ap.apistarly.live (se.serverfuel.live [77.242.152.35])
Date: Wed, 29 Apr 2020 07:55:02 +0100
Subject: YOUR DHL SHIPMENT NOTIFICATION/UPDATE PARCEL NO:DL7593462
Attachment: DHL SHIPMENT NOTIFICATION_PDF.ace

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-29 08:35:26 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
23 of 48 (47.92%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kix54qxu2fuyuecdwdl3mzerxn6nt22kiwzujrnpltko6uk4oodq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

ace 522fde42f4d1698a1043b0d7b66491bb7cd9eb4a45b344c5af5cd4ef515c7387

(this sample)

NanoCore

Executable exe 84087e77b6088ef6e3d9a61f088ea5c6b6cb9bf1c7d852df6a12e745ab112c11

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 84087e77b6088ef6e3d9a61f088ea5c6b6cb9bf1c7d852df6a12e745ab112c11

Comments