MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45479cb8331a6f5f74d411a5e88e6811c666bb9b202a91013f53befb1b6b9f57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 7


Intelligence 7 IOCs YARA 19 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45479cb8331a6f5f74d411a5e88e6811c666bb9b202a91013f53befb1b6b9f57
SHA3-384 hash: d2422d4b2474ed557ff8e8cd4dccd7bc8a9436b90c050734745caaa49c5514045bd4a85cacffce4dfbf8a50802533d62
SHA1 hash: f003483ecde6c1aba60de73cbeb0b45bd7c1a8ae
MD5 hash: e4dc75e9e27b3111e09f5fbbc854ef5b
humanhash: enemy-asparagus-bravo-monkey
File name:localtonet-win-64.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:63'678'838 bytes
First seen:2025-11-24 07:07:39 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1572864:MPQxxO5BAVvKJKePQMqArMvVYapLyxLntEzbJtmLkx:wH5BAo9QM9QKOCE3fm0
TLSH T1EED733E2E03D448D1416E04957926F3644F61AB91DF3CE81679B7352170EBB0ABB28FE
Magika zip
Reporter juroots
Tags:file-pumped NanoCore zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
103
Origin country :
IL IL
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:localtonet.exe
Pumped file This file is pumped. MalwareBazaar has de-pumped it.
File size:153'912'800 bytes
SHA256 hash: c6630c6bdc140e37f2708aada825528c41104a5a58dff9f154e42b6a94c3c692
MD5 hash: 1e7cb4452f6cc74dd659626cd9a3a585
De-pumped file size:9'654'784 bytes (Vs. original size of 153'912'800 bytes)
De-pumped SHA256 hash: c09f95eeb6ade76fab83da5588b4b1df678b1ccabf2cc88ed5a48d0a4a51673d
De-pumped MD5 hash: f39738d2d1bf08a056ce451a22183d40
MIME type:application/x-dosexec
Signature NanoCore
Vendor Threat Intelligence
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=692405777d4abc02d4bca0ec
Tags:
n/a
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug fingerprint microsoft_visual_cc overlay unsafe virus
Link:
https://www.filescan.io/uploads/69240479c4bd66164273ba2d/reports/7dbc693d-9b08-4a6b-b270-a8c787fd2e93/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/45479cb8331a6f5f74d411a5e88e6811c666bb9b202a91013f53befb1b6b9f57
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/45479cb8331a6f5f74d411a5e88e6811c666bb9b202a91013f53befb1b6b9f57
Verdict:
Adware
File Type:
zip
First seen:
2025-11-18T20:15:00Z UTC
Last seen:
2025-11-25T15:02:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/45479cb8331a6f5f74d411a5e88e6811c666bb9b202a91013f53befb1b6b9f57/results?tab=lookup
Score:
75%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/45479cb8331a6f5f74d411a5e88e6811c666bb9b202a91013f53befb1b6b9f57
Gathering data
Threat name:
Win64.PUA.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-11-22 12:48:17 UTC
File Type:
Binary (Archive)
Extracted files:
749
AV detection:
6 of 24 (25.00%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ivdzzobtdjxv65gucgs6rdtichdgno43eavjcaj7ko7pwg3lt5lq._file
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore
Link:
https://tria.ge/reports/251124-jclwjabq8v/
Behaviour
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Any_SU_Domain
Create hunting rule
Author:you
Description:Detect any reference to .su domains or subdomains
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__MemoryWorkingSet
Create hunting rule
Author:Fernando Mercês
Description:Anti-debug process memory working set size check
Reference:http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_Credit_Card_Form
Create hunting rule
Author:NCSC-CH / GovCERT
Description:Detects credit card submission forms in HTML content
Rule name:Detect_Submitting
Create hunting rule
Author:NCSC-CH / GovCERT
Description:Detects login forms in HTML content
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NanoCore

zip 45479cb8331a6f5f74d411a5e88e6811c666bb9b202a91013f53befb1b6b9f57

(this sample)

NanoCore

Executable exe c09f95eeb6ade76fab83da5588b4b1df678b1ccabf2cc88ed5a48d0a4a51673d

  
URLhaus
https://urlhaus.abuse.ch/url/3715643/
  
Delivery method
Distributed via web download
  
Dropping
SHA256 c09f95eeb6ade76fab83da5588b4b1df678b1ccabf2cc88ed5a48d0a4a51673d
  
Dropping
MD5 f39738d2d1bf08a056ce451a22183d40

Comments