MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31a5fdd2b55be2d1790a5b1e5a26dccc79ea0ccb5274996db59daba85cf53b6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31a5fdd2b55be2d1790a5b1e5a26dccc79ea0ccb5274996db59daba85cf53b6a
SHA3-384 hash: 0b4c8d8d9d7d3089460c298fafe5dba52d633998427b1499171311cf631e573830eac35f82eeb34b5411bff4faac60cc
SHA1 hash: d2ab84e366824680417c9aa9c2a4167350d679d4
MD5 hash: 19478356b7135bb952fa3e0db3133a3c
humanhash: iowa-harry-massachusetts-stairway
File name:PREVIOUS INVOICE.lzh
Download: download sample
Signature NanoCore
Create hunting rule
File size:723'037 bytes
First seen:2020-10-22 06:51:02 UTC
Last seen:2020-10-23 09:33:49 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:Fyzph5pM3v4iL8/c+pOT3C5ftbKglnFcr0NhOMHM16oY4tQAnLMZL0S1gcAF:FKpMgiLlT3CbKglnFSlT/tEt9s
TLSH 9FF43399ABC806555EF8063920320F6623FBC97257F0AD91396C3CB43EDD31A77E4A52
Reporter abuse_ch
Tags:lzh NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: [131.153.18.91]
Sending IP: 131.153.18.91
From: yuswan@pertamajaya.com
Subject: RE: PREVIOUS INVOICE
Attachment: PREVIOUS INVOICE.lzh (contains "PREVIOUS INVOICE.exe")

Intelligence

File Origin
# of uploads :
5
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/31a5fdd2b55be2d1790a5b1e5a26dccc79ea0ccb5274996db59daba85cf53b6a/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 02:19:22 UTC
AV detection:
16 of 29 (55.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ggs73uvvlprnc6iklmpfujw4zr46udglkj2js3nvtwv2qxhvhnva._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 31a5fdd2b55be2d1790a5b1e5a26dccc79ea0ccb5274996db59daba85cf53b6a

(this sample)

NanoCore

Executable exe 35975410919029f5c15ea420be97c10c327b94a2aa9e9b044e15660aede8c509

  
Dropping
MD5 2604a4efa854fc6f81cfd215f7164903
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 35975410919029f5c15ea420be97c10c327b94a2aa9e9b044e15660aede8c509

Comments