MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8498bdab6a84e15c21f5b8614cba28aeb029bc9ae030e59d3a42c988b61b2f85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
NanoCore
Vendor detections: 4
| SHA256 hash: | 8498bdab6a84e15c21f5b8614cba28aeb029bc9ae030e59d3a42c988b61b2f85 |
|---|---|
| SHA3-384 hash: | 71bbaa805593543c02c6660a5d6c8e74ef8cd5245cf6262a0890b44fe7fa4ae1aea4cfe4860c6e790cf278a74c5b3688 |
| SHA1 hash: | 110b3626ee1dc269d4035510b4b93d7824b3e9cd |
| MD5 hash: | bcf29e2cdcf96adbf675d0cc367db0a5 |
| humanhash: | happy-louisiana-blossom-emma |
| File name: | a9ee69ee72f096408a9e988d4f19a67f.exe |
| Download: | download sample |
| Signature | NanoCore |
| File size: | 207'872 bytes |
| First seen: | 2020-04-10 19:49:39 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger) |
| ssdeep | 6144:MLV6Bta6dtJmakIM5hs7UBmOKqVotp/wK32l:MLV6BtpmknQmGuAK32l |
| Threatray | 1'102 similar samples on MalwareBazaar |
| TLSH | C314CF6677A84A2FE2DE86BD702251168379C2E398C3F3DE28D451B78F167E10A471D3 |
| Reporter |  abuse_ch |
| Tags: | exe GuLoader NanoCore |
abuse_ch
Payload dropped by GuLoader from the following URL:https://drive.google.com/uc?export=download&id=1SPQdLSj5f4A4A6niXWcEsVtdFSZp5wab
Intelligence
File Origin
# of uploads :
1
# of downloads :
108
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Nanocore
Status:
Malicious
First seen:
2020-04-10 20:35:24 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
30 of 30 (100.00%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
nanocorerat
Similar samples:
+ 1'092 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
2d5bdc08087363cfb191d46dafff4a4364c01f2451c9d2c58cccb6cc5b6a4fc6
Dropped by
MD5 a9ee69ee72f096408a9e988d4f19a67f
Dropped by
MD5 2eed1482ae6d2ae194dbdd48c56d67e8
Dropped by
GuLoader
Dropped by
SHA256 2d5bdc08087363cfb191d46dafff4a4364c01f2451c9d2c58cccb6cc5b6a4fc6
Dropped by
SHA256 1e986ea25e2e8a4cf9bfad472ba024b1e551b0c7a5c6487acc2476e97e781e5b
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_NX | Missing Non-Executable Memory Protection | critical |
| CHECK_PIE | Missing Position-Independent Executable (PIE) Protection | high |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.