MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ef87e8063cfbd87426fb6b0845ec0617b4f5543da5dc35867b5430ca8d9342f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ef87e8063cfbd87426fb6b0845ec0617b4f5543da5dc35867b5430ca8d9342f
SHA3-384 hash: d5e9c38220c8f419e3315dc170b72a5c3774eeae5f7a14f04e36d3a1f1b0ce61bc05ce007d1200d2765fb0290223b9ee
SHA1 hash: 05f04bc5bad10cbf7a8d9bfe75fac3b7a74590cc
MD5 hash: dd49ac7dacfd4e98623da739c100d5e6
humanhash: sad-friend-emma-winter
File name:GLOBAL VISION Trading Est.iso
Download: download sample
Signature NanoCore
Create hunting rule
File size:808'960 bytes
First seen:2020-10-23 06:50:01 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:71Xb5Fnl9RRBLlpv4azMoBtRjSPtyfgdSAEQF+q2jXQsimEp+dAA:7xbrlHLn7zMoJGwnAEhqgh3A
TLSH 9305D0F46744C8A9C85B45B9A83696A77533A20EAC28890D39D5FF0F7E3338350179DB
Reporter abuse_ch
Tags:iso NanoCore


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: web4.allinhost.de
Sending IP: 178.77.72.166
From: sales1@globalvision-kw.com
Subject: REQUEST FOR QUOTATION RFQ# --202010
Attachment: GLOBAL VISION Trading Est.iso (contains "GLOBAL VISION Trading Est.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Strictor.84692.10048.28963.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ef87e8063cfbd87426fb6b0845ec0617b4f5543da5dc35867b5430ca8d9342f/
Threat name:
ByteCode-MSIL.Trojan.Strictor
Create hunting rule
Status:
Suspicious
First seen:
2020-10-23 02:03:09 UTC
AV detection:
9 of 48 (18.75%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=f34h5addz66yoqtpw2yiixwamf5u6vkd3jo4gwdhwvbqzkgzgqxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

iso 2ef87e8063cfbd87426fb6b0845ec0617b4f5543da5dc35867b5430ca8d9342f

(this sample)

NanoCore

Executable exe d64ff1049db3e5f29c8bb4ffb78e5ef42067ecd90d1524ea6f1fdf39d944c4d0

  
Dropping
MD5 8423acdd4a57d9195e25734b2d1e555a
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d64ff1049db3e5f29c8bb4ffb78e5ef42067ecd90d1524ea6f1fdf39d944c4d0

Comments