MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51117090a3e4aef74761da060131be47a818263450f10bd02a900cf87a5fa748. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51117090a3e4aef74761da060131be47a818263450f10bd02a900cf87a5fa748
SHA3-384 hash: 56084442f0a9235d70fab8b1109296dcafe8595fa149c724c32d859056aed8e98733860106e05dd467ba0e9cb4f2ca74
SHA1 hash: 0f029cdc83972e2b4fbe3e6e1a34325b214da709
MD5 hash: b29e93572a55c8bd3cf7c2a261007468
humanhash: sad-diet-table-mars
File name:INV.IMG
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'245'184 bytes
First seen:2020-05-21 07:14:24 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 3072:5JMNh39MVPc9KjYRNGB2LsSNETHAtSLEZWrrS9gHeh06vAR2b89aUn29QLqpRyPR:g0pU1BsCz0
TLSH 004570AA937C2B25C1FE6779B032801067FCD68BDBC5D584BE4C43C80B96BA15763B58
Reporter abuse_ch
Tags:img NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: server.swaindistribution.com
Sending IP: 207.7.84.133
From: ar@swaindistribution.com
Subject: Re: Unpaid Invoice
Attachment: INV.IMG (contains "INV.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Geniso
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 03:21:00 UTC
AV detection:
14 of 30 (46.67%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=keixbefd4sxpor3b3idacmn6i6ubqjrukdyqxubksagpq6s7u5ea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

img 51117090a3e4aef74761da060131be47a818263450f10bd02a900cf87a5fa748

(this sample)

NanoCore

Executable exe aa025c5073c737b73d42bc9295b7622e9c0b2db8a7bb9f480ba45a76a18259f3

  
Dropping
MD5 e7dd77e585a5c97990b4ca1dc4267247
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aa025c5073c737b73d42bc9295b7622e9c0b2db8a7bb9f480ba45a76a18259f3

Comments