MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca25f2630e0e832c6f4f7590cbd13470fc43d7813b28a8960f53ece180311442. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca25f2630e0e832c6f4f7590cbd13470fc43d7813b28a8960f53ece180311442
SHA3-384 hash: 50698ed800ad7d72e05156a6fdc6ac2c760d05828723fa02e97e82d035bf629918ded8c03429acf39f6ff90edf111261
SHA1 hash: 26a84edf73ca1d84776f33bda20d901404682931
MD5 hash: f45f10ab27022e1603d9382932cfc78c
humanhash: speaker-nine-shade-queen
File name:Urgent request of SOA & Payment Swift.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:552'228 bytes
First seen:2020-09-01 05:25:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:hGBMGIwNMHdDn/E6wg86p2NLZrZHeftww2XED749:omuedrKg8Nt5Jeftww2D
TLSH AEC423F98B6E3C13E50463748158F6CFC232A14A379C032F99D9F29ECAF357956A9244
Reporter cocaman
Tags:NanoCore rar


Avatar
cocaman
Malicious email
From: "jolly.nabakunda" <jolly.nabakunda@movit.co.ug>
Received: from movit.co.ug (unknown [185.222.57.241])
Date: 31 Aug 2020 20:46:59 -0700
Subject: RE: Urgent request of SOA/Payment swift
Attachment: Urgent request of SOA & Payment Swift.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
202
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca25f2630e0e832c6f4f7590cbd13470fc43d7813b28a8960f53ece180311442/
Threat name:
ByteCode-MSIL.Infostealer.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-09-01 05:27:05 UTC
File Type:
Binary (Archive)
Extracted files:
410
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zis7eyyob2bsy32powimxujuod6ehv4bhmukrfqpkpwodabrcrba._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ca25f2630e0e832c6f4f7590cbd13470fc43d7813b28a8960f53ece180311442

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar ca25f2630e0e832c6f4f7590cbd13470fc43d7813b28a8960f53ece180311442

(this sample)

NanoCore

Executable exe 434afdd1d26fe65ea4803d0ab227247da43803a35f8d4ef23ad10ea300af9b31

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 434afdd1d26fe65ea4803d0ab227247da43803a35f8d4ef23ad10ea300af9b31
  
Dropping
NanoCore

Comments