MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 026b46ce13b69a6e48fea6e47360d4680d61dbd075a10c52f4d48591af113bb1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 026b46ce13b69a6e48fea6e47360d4680d61dbd075a10c52f4d48591af113bb1
SHA3-384 hash: e161fea21dbb0c04923783e21af9ba0491e2ecbc4c921be09640b0443b7923ece8e8b326b6316ba4c47ab2437e30aebd
SHA1 hash: 49cd4ca3556dbdfbe5c506a4276f1d66dd3e0887
MD5 hash: ec76866912584f5abde7f6c6bcc6b281
humanhash: pizza-hawaii-victor-ack
File name:PURCHASE ORDER No.F1718 9157.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:565'140 bytes
First seen:2020-09-10 05:32:16 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:PUWyh1KB90dB07xkqF1L6Smza9rNxfeQZTaugNQARH:PUWyhQ90dBkL6SmONB7FautqH
TLSH 35C423B5334B15368D29E86CF94F2770359AE6EBE8D98C41CACBDC03C99BD295C36910
Reporter cocaman
Tags:NanoCore rar


Avatar
cocaman
Malicious email
From: "Esra Kennedy" <esrakennedy@gracecole.co.uk>
Received: from gracecole.co.uk (unknown [185.222.57.241])
Date: 09 Sep 2020 22:28:35 -0700
Subject: RE: PURCHASE ORDER No. TF1718 / 9157
Attachment: PURCHASE ORDER No.F1718 9157.rar

Intelligence

File Origin
# of uploads :
1
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200910-0746.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/026b46ce13b69a6e48fea6e47360d4680d61dbd075a10c52f4d48591af113bb1/
Threat name:
ByteCode-MSIL.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-09-10 00:44:52 UTC
File Type:
Binary (Archive)
Extracted files:
419
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ajvuntqtw2ng4sh6u3shgygunagwdw6qowqqyuxu2sczdlyrhoyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/026b46ce13b69a6e48fea6e47360d4680d61dbd075a10c52f4d48591af113bb1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 026b46ce13b69a6e48fea6e47360d4680d61dbd075a10c52f4d48591af113bb1

(this sample)

NanoCore

Executable exe 9f4390c14715f1925addce9b86bdb5b52e3b80563eb42531548ee360b9b7044e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9f4390c14715f1925addce9b86bdb5b52e3b80563eb42531548ee360b9b7044e
  
Dropping
NanoCore

Comments