MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33ee2fe1cf8a783681a241cf3f6bf3f1b6a7f2911215cfe86f410216aace4f99. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33ee2fe1cf8a783681a241cf3f6bf3f1b6a7f2911215cfe86f410216aace4f99
SHA3-384 hash: a4512f821856ccba4f446106333768bce1cff208a93674c1e13c0e82788da0ccc22c65bd2ab2b0ca0c90c1b598437964
SHA1 hash: 813c60be2fac8c7aef8fd78814216bd194b2d51c
MD5 hash: aadcd9d472f90bcce5f4496616bb439a
humanhash: blue-xray-gee-mexico
File name:lista wymaganych zamówień.r01
Download: download sample
Signature NanoCore
Create hunting rule
File size:790'018 bytes
First seen:2020-08-05 09:33:09 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 12288:JtVZMno3RkhnxcgX66F8mEsRciMTbHlZB0xfoDvEbHZ/Jwb/ynUtQeLc:HRDgqw8mEqMTLlZB0xfeWyaeg
TLSH 64F433F00CBFCA4D89B40D4D57D4EA7FE4F29B1B1C458826A588C873436E2BE69A3507
Reporter abuse_ch
Tags:geo NanoCore POL r01 RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: hwsrv-758891.hostwindsdns.com
Sending IP: 104.168.203.3
From: Franciszek Andrzejewski <info@loburig.com>
Subject: RE: 05.08.2020/lista wymaganych zamówień
Attachment: lista wymaganych zamówień.r01 (contains "lista wymaganych zamówień.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/33ee2fe1cf8a783681a241cf3f6bf3f1b6a7f2911215cfe86f410216aace4f99/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 09:35:05 UTC
AV detection:
19 of 48 (39.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gpxc7yoprj4dnancihht627t6g3kp4urcik472dpiebbnkwoj6mq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/33ee2fe1cf8a783681a241cf3f6bf3f1b6a7f2911215cfe86f410216aace4f99

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

r01 33ee2fe1cf8a783681a241cf3f6bf3f1b6a7f2911215cfe86f410216aace4f99

(this sample)

NanoCore

Executable exe 2e5c106e46742f3396ac7b2fb74f0aff1981ea83fc99bfbaa6a1fea1699b9246

  
Dropping
MD5 db146573d690fe5a153d2b3bd1d7b212
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2e5c106e46742f3396ac7b2fb74f0aff1981ea83fc99bfbaa6a1fea1699b9246

Comments