MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ba6d1999efdc302195117b3719272bf5a94ec7e84d67190cbeaa79b3b27fcde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ba6d1999efdc302195117b3719272bf5a94ec7e84d67190cbeaa79b3b27fcde
SHA3-384 hash: 6947c5cfd22fe41b03f59255d4a3a8963216ac9741b4266a5e825545bb80b18f43258d97fc23e0bb3e984fe11d18a34a
SHA1 hash: 90f963be86cef2673b33b98b84cc36cebea8ed76
MD5 hash: 5a1da652f9cdaa77c1bb21fa1506569d
humanhash: april-seven-violet-cat
File name:BULK VESSEL CONTRACT_N0 914-20.pdf.lzh
Download: download sample
Signature NanoCore
Create hunting rule
File size:22'834 bytes
First seen:2020-10-14 16:29:20 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:OgzOO//U50PHLTV5ABJBSt3snpJssPokDD5NvRZtAARn9NtDoFEWQsoPV8OrQce7:pzd//U5ITV5sBS1snrsSJRHHfHoNQlVo
TLSH C3A2D060CEFE65B164B6F4F83409B8D3E194512DC784AF248ECE20416F2EEFA9750769
Reporter abuse_ch
Tags:lzh NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: zmta01.tradeindia.com
Sending IP: 14.140.162.138
From: Nguyen@sumitomochemicals.com
Subject: BULK VESSEL OF 250MT APPROVED CONTRACT
Attachment: BULK VESSEL CONTRACT_N0 914-20.pdf.lzh (contains "BULK VESSEL CONTRACT_N0 914-20.pdf.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Mal.RarMal-C.21732.20436.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ba6d1999efdc302195117b3719272bf5a94ec7e84d67190cbeaa79b3b27fcde/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 14:27:17 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jotndgm67xbqegkrc6zxdetsx5njj3d6qtlhdegl5ktzwozh7tpa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4ba6d1999efdc302195117b3719272bf5a94ec7e84d67190cbeaa79b3b27fcde

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 4ba6d1999efdc302195117b3719272bf5a94ec7e84d67190cbeaa79b3b27fcde

(this sample)

NanoCore

Executable exe 22221b72f894bb076ead64d8e6c09daf40692586a2b9f3409d91ae72c0a001ee

  
Dropping
MD5 417b32eb6296b9e55cd7c8c3ca97afb4
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 22221b72f894bb076ead64d8e6c09daf40692586a2b9f3409d91ae72c0a001ee

Comments