MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 442f002f1951a36c98fdd7fca7c55a5c4cb06c915ef8959cd825fc2957de4bb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 442f002f1951a36c98fdd7fca7c55a5c4cb06c915ef8959cd825fc2957de4bb8
SHA3-384 hash: 31b5553d71ab6c593e41b53ad4cdf16dffa1ec9aaacc8f69cb8a175cc509f8702dfddcea27f425f2b8785399eafdfbd1
SHA1 hash: 17c3a0aebe51a62c5db7980b8ff41838fb0225a6
MD5 hash: e60924baa2a6e38e7cea1c8e1522913b
humanhash: seventeen-colorado-pennsylvania-gee
File name:remittance copy.pdf.iso
Download: download sample
Signature NanoCore
Create hunting rule
File size:609'399 bytes
First seen:2021-02-26 14:31:17 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:GgTo/A4bcmGxvzo7cuf1Fmnv+MyYtnKApXGb29Ot8MHidoiVGMZn7aHrgY+:DTYXbcmGxvk4utFmnv+/uKApWb2T3qp+
TLSH 5FD42300F36DEB4A583FFAF906C1A5D904911EFBBA7DD45A56DB0C32DAC24780278176
Reporter abuse_ch
Tags:Endurance iso NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: 192-254-204-11.unifiedlayer.com
Sending IP: 192.254.204.11
From: Accgt2 <mhdd_phoenix@yahoo.com>
Subject: Re: BILLING INVOICE:
Attachment: remittance copy.pdf.iso (contains "remittance copy.pdf.exe")

NanoCore RAT C2:
shahzad73.casacam.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/442f002f1951a36c98fdd7fca7c55a5c4cb06c915ef8959cd825fc2957de4bb8/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-26 14:32:06 UTC
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=iqxqalyzkgrwzgh5276kprk2lrgla3erl34jlhgyex6csv66jo4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 442f002f1951a36c98fdd7fca7c55a5c4cb06c915ef8959cd825fc2957de4bb8

(this sample)

NanoCore

Executable exe 117a47316ab68fefcd1ab9c8c00a763852cb569fa5a487fe8dd4efdf8702f3aa

  
Dropping
MD5 f287d8b2fe69fec7039f0543b8ffb145
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 117a47316ab68fefcd1ab9c8c00a763852cb569fa5a487fe8dd4efdf8702f3aa

Comments