MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f43af493e29bd1b5b253ae57af23e54669a698013875de4475ea5e9e24ab129. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5f43af493e29bd1b5b253ae57af23e54669a698013875de4475ea5e9e24ab129
SHA3-384 hash: 7b540fd23aeb6bd7d645b73119882f7e330cd1c577c79c702ff3bf50b4b002595482b9d5ddc0139eb14f9e864c64a7eb
SHA1 hash: b56737edb20698ae577bccfa87527dc886cc00da
MD5 hash: 221bb2fc5aa8e8bd053c2f3813cb5672
humanhash: football-fifteen-east-ink
File name:Quotation Laminate - GIH.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:340'763 bytes
First seen:2020-08-19 13:41:00 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:zIWEXAy4svvl8BY19+IqpxRXpe59RKw0LWlsEkv2XwafI4DzilFducblFTKYi18a:zIW44ASBY1oFxu54Wls52ZfIllFTRFTY
TLSH 6B7423C33C3F4D11997579C99E6640F064BE2C90E463B361AF1DDCA3D6900D9BE7298A
Reporter abuse_ch
Tags:NanoCore RAT zip


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: amassgroup.com
Sending IP: 37.48.85.242
From: "Ivy Zhang" <ivy.zhang@amassgroup.com>
Subject: RE: Quotation Request - Backing Laminate - GIH
Attachment: Quotation Laminate - GIH.zip (contains "Quotation Laminate - GIH.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
125
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5f43af493e29bd1b5b253ae57af23e54669a698013875de4475ea5e9e24ab129/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 22:19:54 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l5b26sj6fg6rwwzfhlsxv4r6krtju2macodv3zchl2s6tyskweuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5f43af493e29bd1b5b253ae57af23e54669a698013875de4475ea5e9e24ab129

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip 5f43af493e29bd1b5b253ae57af23e54669a698013875de4475ea5e9e24ab129

(this sample)

NanoCore

Executable exe 8a5ae789ab7a7fe7d2d2bd23a633ae2d4a06b8b3dd93d7ea716847209067a92d

  
Dropping
MD5 d8a13606c45b5b585402f009044a8677
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8a5ae789ab7a7fe7d2d2bd23a633ae2d4a06b8b3dd93d7ea716847209067a92d

Comments