MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2145a20afc05f9c28a63ac6e13909d1b3bc1bc7862d22a3475b8bd5510ca4f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d2145a20afc05f9c28a63ac6e13909d1b3bc1bc7862d22a3475b8bd5510ca4f4
SHA3-384 hash: f902071abe254c67219224ae2cd2f638631975e2ff84c91018e44e88afa13799422e953c3d9397e3d9b1b06629b31985
SHA1 hash: 5fb76aeab3a212fa561f5b03095da87a4750e69b
MD5 hash: 3f67a73e21c100365585e23ce369755c
humanhash: bacon-king-wolfram-freddie
File name:PURCHASE ORDER.PDF.gz
Download: download sample
Signature NanoCore
Create hunting rule
File size:334'046 bytes
First seen:2020-07-21 07:42:58 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 6144:ecDrbrnxE8nohZRKvGILCfnegqHLP+ecK1Bku6+fh40xXzDuCPpTb:ecD1TnohZRKuvB4L+eH1j6+JhxzykpTb
TLSH 6D6423666C162FD7CA1A28410F0CB3AB80BB52FE87CD451757DEDA4DB374A1C64AF248
Reporter abuse_ch
Tags:gz NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: sv1.per.eftel.com
Sending IP: 203.24.101.178
From: Taimi Sjöström <brysylv9@pnc.com.au>
Reply-To: Taimi Sjöström <purchase-team@citofoniarintec.cl>
Subject: New Order.
Attachment: PURCHASE ORDER.PDF.gz (contains "PURCHASE ORDER.exe")

NanoCore RAT C2:
apaduckdns.duckdns.org:54984 (46.243.144.12)

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d2145a20afc05f9c28a63ac6e13909d1b3bc1bc7862d22a3475b8bd5510ca4f4/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-21 07:44:08 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ikfuifpybpzykfghldocoij2gz3yg6hqywsfi2hlof5kuimut2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d2145a20afc05f9c28a63ac6e13909d1b3bc1bc7862d22a3475b8bd5510ca4f4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

gz d2145a20afc05f9c28a63ac6e13909d1b3bc1bc7862d22a3475b8bd5510ca4f4

(this sample)

NanoCore

Executable exe f0bdd59b67a442209f68d9adf125fbadd7e99324ca917822d5f5f29e976b5b26

  
Dropping
MD5 37ca2dcb84070656527a45c9b3ff8589
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f0bdd59b67a442209f68d9adf125fbadd7e99324ca917822d5f5f29e976b5b26

Comments