MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6170cf6b8177798371a0a7281d296bd79584a4c8d4aa2f2643cfa7d1c95b238b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6170cf6b8177798371a0a7281d296bd79584a4c8d4aa2f2643cfa7d1c95b238b
SHA3-384 hash: d36636c1e1debadcda795e637b347d64f0846f6e790f456c38a7b6b7f772f138f661816d9687018d241b12d63a86e3fc
SHA1 hash: ed775ebd6ffab54b378f1ddf35ccc4e6c3d7b197
MD5 hash: a4b3eb5488ccb7d0bd285be1baedda31
humanhash: river-summer-artist-saturn
File name:invoice.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:361'821 bytes
First seen:2020-05-07 09:48:49 UTC
Last seen:2020-05-07 11:02:38 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:tba93fo2ny21i/H6UwQMs+nzcrkVhj40TVkpj4InJaOmMgrbuppJIZrW:Exu2ifdL+nUq406j4Wa/ZrbuppJEW
TLSH E6742395A080D52ED0B731476E012996430A9E97F7145C4F8FBB16CA2BDF7F61CBA8C8
Reporter jarumlus
Tags:NanoCore

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21615.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23810.ZipHeur.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-07 10:35:25 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
21 of 31 (67.74%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mfym624bo54yg4nau4ub2kll26kyjjgi2svc6jsdz6t5dsk3eofq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip 6170cf6b8177798371a0a7281d296bd79584a4c8d4aa2f2643cfa7d1c95b238b

(this sample)

NanoCore

Executable exe f3226374fbeefb1fcd90ab7d17d4570994dd63f8efb4bf59048eced4a042f0ba

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f3226374fbeefb1fcd90ab7d17d4570994dd63f8efb4bf59048eced4a042f0ba
  
Dropping
MD5 b9953aa6dc9d54b7c8151ce38ffe655d

Comments