MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 255fca7a58b0bf7c2c57cbfc648650db8abec84b57a6a32592bd6180f3d3c8af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 255fca7a58b0bf7c2c57cbfc648650db8abec84b57a6a32592bd6180f3d3c8af
SHA3-384 hash: df8d4b1a8bd6a3954f465157e8654e4248da37b3fa7484cdacd3a9dda92e3b789575872f51e4b0ff2e3a8b3a40cfd02e
SHA1 hash: 277a04bc45ad23b3c85e856f0b393841ea3845d4
MD5 hash: 8edb3acb002c359ac5265043c55ecc7e
humanhash: triple-charlie-saturn-michigan
File name:OUTSTANDING STATEMENT.r01
Download: download sample
Signature NanoCore
Create hunting rule
File size:565'124 bytes
First seen:2020-09-10 05:25:02 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 12288:GUWyh1KB90dB07xkqF1L6Smza9rNxfeQZTaugNQARF:GUWyhQ90dBkL6SmONB7FautqF
TLSH C3C423B5334B15368D29E86CF94F27B0359AE6EBE8D98C41CACBDC03C99BD285C32510
Reporter cocaman
Tags:NanoCore r01


Avatar
cocaman
Malicious email
From: "Chetan Domali" <accounts1@zaleship.com>
Received: from zaleship.com (unknown [37.48.85.197])
Date: 10 Sep 2020 01:53:27 -0700
Subject: RE: OUTSTANDING STATEMENT
Attachment: OUTSTANDING STATEMENT.r01

Intelligence

File Origin
# of uploads :
1
# of downloads :
184
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Rogue.0hr.20200910-0746.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/255fca7a58b0bf7c2c57cbfc648650db8abec84b57a6a32592bd6180f3d3c8af/
Threat name:
ByteCode-MSIL.Backdoor.Crysan
Create hunting rule
Status:
Malicious
First seen:
2020-09-10 00:38:29 UTC
File Type:
Binary (Archive)
Extracted files:
419
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=evp4u6sywc7xylcxzp6gjbsq3ofl5sclk6tkgjmsxvqyb46tzcxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/255fca7a58b0bf7c2c57cbfc648650db8abec84b57a6a32592bd6180f3d3c8af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

r01 255fca7a58b0bf7c2c57cbfc648650db8abec84b57a6a32592bd6180f3d3c8af

(this sample)

NanoCore

Executable exe 9f4390c14715f1925addce9b86bdb5b52e3b80563eb42531548ee360b9b7044e

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9f4390c14715f1925addce9b86bdb5b52e3b80563eb42531548ee360b9b7044e
  
Dropping
NanoCore

Comments