MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46f0bdf29f5e98be379bc1fea1b44306c14f58305fd237f45039e625e3741cc4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46f0bdf29f5e98be379bc1fea1b44306c14f58305fd237f45039e625e3741cc4
SHA3-384 hash: 80908131fee6ed32436c7ca19204be920ac2d7ac2d4b883cb2d32219a473221bf4a2fdc8355c505c4ffb3f3c3489e56e
SHA1 hash: cb5b06fb8caf354b969f551523b200f9c686e8fe
MD5 hash: 588efab1ef2fe1a2d2d832002f9f2d01
humanhash: california-seventeen-oscar-uncle
File name:Remittance Form-Payu.img
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'441'792 bytes
First seen:2021-06-18 06:00:42 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:grnhlm4S4F3M9yx/vmhLsSbLfZs7CQnwQ8b7y8obb8ewdPqNSQmSOlhMWTrozIyx:gdWuvc3Lfa+2F8eCSHodjA
TLSH C665C0102AEA5115F173AF745FD079929BBEFE237702E45E2895338B0733A81CD9163A
Reporter cocaman
Tags:img NanoCore


Avatar
cocaman
Malicious email (T1566.001)
From: "PAYU INTERNATIONAL <sales8@oxy99.in>" (likely spoofed)
Received: "from 162-144-100-85.unifiedlayer.com (unknown [162.144.38.36]) "
Date: "Fri, 18 Jun 2021 00:55:49 +0000"
Subject: "Inward remittance"
Attachment: "Remittance Form-Payu.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.852.4818.9939.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46f0bdf29f5e98be379bc1fea1b44306c14f58305fd237f45039e625e3741cc4/
Threat name:
Win32.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2021-06-18 03:05:04 UTC
File Type:
Binary (Archive)
Extracted files:
37
AV detection:
8 of 45 (17.78%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=i3yl34u7l2ml4n43yh7kdncda3au6wbql7jdp5cqhhtcly3udtca._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/46f0bdf29f5e98be379bc1fea1b44306c14f58305fd237f45039e625e3741cc4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

img 46f0bdf29f5e98be379bc1fea1b44306c14f58305fd237f45039e625e3741cc4

(this sample)

NanoCore

Executable exe 00283c596db208ba1bc96ecac73c67fba068699850a31bb9dbcbb44b633d0b2f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 00283c596db208ba1bc96ecac73c67fba068699850a31bb9dbcbb44b633d0b2f
  
Dropping
NanoCore

Comments