MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 49bb04d68f01a602b646de55802cd5791d49c8437e048f990bc97c2fbcc387c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 49bb04d68f01a602b646de55802cd5791d49c8437e048f990bc97c2fbcc387c6
SHA3-384 hash: ef45cfb40062f2000ed168cac79fbe0baa02205f70329bf946f31c2f01963bc1b9728d9575a6817bb07a1551ae35e333
SHA1 hash: e09e8a56d1bc7fff565b320774d4138aa3c73cf8
MD5 hash: 682a1a214530d50b6f83262e6c596933
humanhash: artist-lithium-princess-pip
File name:Quotation8794A220720_SA_GIANG_TRADING_CO_ LTD.arj
Download: download sample
Signature NanoCore
Create hunting rule
File size:396'335 bytes
First seen:2020-08-05 08:48:06 UTC
Last seen:Never
File type: arj
MIME type:application/x-rar
ssdeep 12288:LJctYYJX/NCxxwQUDj1n/oWPbaYCyLQ/BQPa:C6YB4xxD6p/oWTaTf6y
TLSH E08423C18863E4E815112E8D222B6D01DAF5EA32B69F7F1B7DD4E07C743358647CCA9A
Reporter abuse_ch
Tags:arj NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: 7455.serverov.com
Sending IP: 188.93.74.55
From: Nguyen Thi Hong Hanh <sales.nbhlinh@sagiangvn.com>
Subject: Quotation8794A200720
Attachment: Quotation8794A220720_SA_GIANG_TRADING_CO_ LTD.arj (contains "Quotation8794A220720_SA_GIANG_TRADING_CO_ LTD.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/49bb04d68f01a602b646de55802cd5791d49c8437e048f990bc97c2fbcc387c6/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 08:49:10 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jg5qjvupagtafnsg3zkyalgvpeoutscdpyci7gilzf6c7pgdq7da._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/49bb04d68f01a602b646de55802cd5791d49c8437e048f990bc97c2fbcc387c6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

arj 49bb04d68f01a602b646de55802cd5791d49c8437e048f990bc97c2fbcc387c6

(this sample)

NanoCore

Executable exe 9d44ded1da60c6d985cd16f0b98954f746f83f3d7d093f15f30a88eb14441e0a

  
Dropping
MD5 c29eeba1e0bc8a80a10d4e8e947feebb
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9d44ded1da60c6d985cd16f0b98954f746f83f3d7d093f15f30a88eb14441e0a

Comments