MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0cf25fe271218e59c65ff83b2ab0e9184f9082087c92d7846721ffcb526eab6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0cf25fe271218e59c65ff83b2ab0e9184f9082087c92d7846721ffcb526eab6b
SHA3-384 hash: 4d9a89eddb3b24759766b70cead9e94abb6bc531853797021766810649a1df96d13e8206245b011a84863fd22177f878
SHA1 hash: 3e66c03fc2d6df5f1c7a6db8c1e7b5b2eea4485c
MD5 hash: cb1e0a66e8b8b7e360166aed8e95c536
humanhash: shade-delaware-uranus-missouri
File name:OUTSTANDING PAYMENT.r00
Download: download sample
Signature NanoCore
Create hunting rule
File size:551'995 bytes
First seen:2020-09-03 04:40:03 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:eNDX6hIF18DASw4OrphdI8ryaxedy/+B9eTpiwp4twwrhPpDD7c4Ib:eBX6oUKd7PedWIeTpf4twwrxpgH
TLSH C4C423F77E062E4B274E30FF11E51C4B0A3A759F859005CB91E3AA79DCE2758E0589A3
Reporter cocaman
Tags:NanoCore r00


Avatar
cocaman
Malicious email
From: "DO TRANG" <jamaisvu76@shengyang.co>
Received: from shengyang.co (unknown [185.222.57.241])
Date: 02 Sep 2020 20:30:36 -0700
Subject: RE: OUTSTANDING PAYMENT
Attachment: OUTSTANDING PAYMENT.r00

Intelligence

File Origin
# of uploads :
1
# of downloads :
189
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200904-0808.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0cf25fe271218e59c65ff83b2ab0e9184f9082087c92d7846721ffcb526eab6b/
Threat name:
Win32.Trojan.CryptInject
Create hunting rule
Status:
Malicious
First seen:
2020-09-02 21:35:37 UTC
File Type:
Binary (Archive)
Extracted files:
410
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=btzf7ytreghftrs77a5svmhjdbhzbaqipsjnpbdheh74wutovnvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0cf25fe271218e59c65ff83b2ab0e9184f9082087c92d7846721ffcb526eab6b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

r00 0cf25fe271218e59c65ff83b2ab0e9184f9082087c92d7846721ffcb526eab6b

(this sample)

NanoCore

Executable exe 2042f931e00f8800c6491bbb74c973d4187f226bda73dec18e2437f16d20a21e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2042f931e00f8800c6491bbb74c973d4187f226bda73dec18e2437f16d20a21e

Comments