MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e47b75248bf182e69609a841aa57157f72ea0fd3eea4e104b9d3f2de1e2bea99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e47b75248bf182e69609a841aa57157f72ea0fd3eea4e104b9d3f2de1e2bea99
SHA3-384 hash: 8327b6fcf0bb8f90680cc16fde90073bf3e99fd74640569ca04e0d4a59bbe10396d587f8090ece5cdd982983f213fd91
SHA1 hash: 0b1baee197acefa3a4fe3487f7d04ed8b2c8f51d
MD5 hash: 3cb580efe8f3d99838c7dbee0ceee38f
humanhash: spaghetti-triple-venus-ack
File name:invoice.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:426'517 bytes
First seen:2020-08-12 07:24:23 UTC
Last seen:2020-08-12 07:25:48 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:clqFbL0xEmDgDM5iVleJAYQAx+oxaRvKnBl+:K8L0xE5ubx+o2ol+
TLSH EF942362E3E51341CD40867FF235C439960FB4E89A8812326027A8F29EA154DBF96D3F
Reporter cocaman
Tags:NanoCore zip


Avatar
cocaman
Malicious email
From: Cindy <imasst@saifeeship.com>
Received: from saifeeship.com (unknown [37.48.85.227])
Date: 04 Aug 2020 00:17:03 -0700
Subject: Updated invoice
Attachment: invoice.zip

Intelligence

File Origin
# of uploads :
2
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21615.ZipHeur.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.23810.ZipHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e47b75248bf182e69609a841aa57157f72ea0fd3eea4e104b9d3f2de1e2bea99/
Threat name:
ByteCode-MSIL.Trojan.SmartAssembly
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 00:10:09 UTC
File Type:
Binary (Archive)
Extracted files:
13
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4r5xkjel6gbonfqjvba2uvyvp5zoud6t52socbfz2pzn4hrl5kmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e47b75248bf182e69609a841aa57157f72ea0fd3eea4e104b9d3f2de1e2bea99

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip e47b75248bf182e69609a841aa57157f72ea0fd3eea4e104b9d3f2de1e2bea99

(this sample)

NanoCore

Executable exe 5912943a6663ba8fe6c8a8d203d53dca13cd1fa5cc51a37b7eed8a658c4d7b05

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5912943a6663ba8fe6c8a8d203d53dca13cd1fa5cc51a37b7eed8a658c4d7b05
  
Dropping
NanoCore

Comments