MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2cd4638133307ab93c9d90057e9952c1b7daeea2a4517f176ecceb2972d796f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2cd4638133307ab93c9d90057e9952c1b7daeea2a4517f176ecceb2972d796f7
SHA3-384 hash: a9e0dfb42c141d9c7e72d626e54db0646aa1bf26cd2c6ccfa91aaf802caec4332726d3fab9f68e78c52a35683a3efabd
SHA1 hash: 45fa34728d08978e352dbf93db545c7379427e3e
MD5 hash: 3b92691b1e2276d6ae2ee0aa39c6f693
humanhash: ten-equal-romeo-one
File name:Scan.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:539'747 bytes
First seen:2021-02-10 08:11:48 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:lB6JoovkvdgNM8ruRt25YruM45xbOC5pcf06wv:lwJoocvd+T4t2Go5VOCTcf06a
TLSH 33B433E9A1568A5F84B40AA7835F377E57329298739C1B5C3FDF792C02A63BC10F5908
Reporter abuse_ch
Tags:NanoCore rar RAT Yahoo


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: sonic317-49.consmr.mail.gq1.yahoo.com
Sending IP: 98.137.66.175
From: Yahoo@automailnoreply <unimarkpharma@yahoo.com>
Subject: Re: Important document
Attachment: Scan.rar (contains "Scan.exe")

NanoCore RAT C2:
innocentbooii.hopto.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2cd4638133307ab93c9d90057e9952c1b7daeea2a4517f176ecceb2972d796f7/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-10 08:12:06 UTC
AV detection:
5 of 47 (10.64%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ftkghajtgb5lspe5sacx5gksyg35v3vcurix6f3oztvss4wxs33q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2cd4638133307ab93c9d90057e9952c1b7daeea2a4517f176ecceb2972d796f7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 2cd4638133307ab93c9d90057e9952c1b7daeea2a4517f176ecceb2972d796f7

(this sample)

NanoCore

Executable exe f3479283e386b944f842855f523933896cc7266e4860b75260eae3269eba8a69

  
Dropping
MD5 6ec9299e208314554a41a24eec6035c4
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f3479283e386b944f842855f523933896cc7266e4860b75260eae3269eba8a69

Comments