MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3bdc5a39ac5ec04f1770bd61c98da6a6bd2b26d512c8c3ad1a59c31c0f327c80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3bdc5a39ac5ec04f1770bd61c98da6a6bd2b26d512c8c3ad1a59c31c0f327c80
SHA3-384 hash: 7dcc485b42ba22c066d74696874b95e926fa5cc64792a95ed2f39d771d4c063c5b7312e41a6d6125635601494598ecb0
SHA1 hash: 6663bb9d6485dc1af137bcb32f07a6e7a131d640
MD5 hash: b4bb8bfccf0ebe03c1764c211470a4d2
humanhash: wolfram-zulu-speaker-high
File name:ACH deposit.img
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-05 09:21:19 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:HnRi0WFin0IIuPhHnaoDoQYj4a6qegnQgixyFD462CAfte:HsF6DIu1naaYjB9RiS467E
TLSH 7E45E01D36905409F1BA0E3F9C7145838E76F85FDE12D61B3ABE1268077E6ACAC60F52
Reporter abuse_ch
Tags:img NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: server.amcham.or.id
Sending IP: 172.104.32.98
From: no-reply@amcham.or.id
Subject: TT ACH202093880 LLC paid
Attachment: ACH deposit.img (contains "6NkUbTVjGQnyaUf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
83
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3bdc5a39ac5ec04f1770bd61c98da6a6bd2b26d512c8c3ad1a59c31c0f327c80/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 06:06:29 UTC
AV detection:
21 of 48 (43.75%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hpofuonml3ae6f3qxvq4tdngu26swjwvclemhli2lhbrydzspsaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NanoCore
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3bdc5a39ac5ec04f1770bd61c98da6a6bd2b26d512c8c3ad1a59c31c0f327c80

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

img 3bdc5a39ac5ec04f1770bd61c98da6a6bd2b26d512c8c3ad1a59c31c0f327c80

(this sample)

NanoCore

Executable exe 5e3140ed7841e6893114a0d4d9c5ee239736449aaba20d2c8939a051e5ef21c5

  
Dropping
MD5 32d6b21c3fe18df44de8a513244fffd7
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5e3140ed7841e6893114a0d4d9c5ee239736449aaba20d2c8939a051e5ef21c5

Comments