MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 562995f1a0726e871a099bab7e8a07da7a734fc7392741889375f02c2fa6046a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 562995f1a0726e871a099bab7e8a07da7a734fc7392741889375f02c2fa6046a
SHA3-384 hash: c8fee871a968b8f0555286cabddcc4f4ab8c2fd64f00a0990f9fa8242d5add7f03b76dfc81e6a0651bef345bfd9e50b9
SHA1 hash: 3d20fea49cf1f7a4fd0cb98cf5f9343aa129737e
MD5 hash: 0e4f0013131e8d18e96ece7e5b5952aa
humanhash: cardinal-artist-green-texas
File name:202088466387467446477PRODUCTLIST.xz
Download: download sample
Signature NanoCore
Create hunting rule
File size:503'409 bytes
First seen:2020-10-19 06:27:27 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 12288:VVRIPLZ1LLn6OW+3zE4FHHH9hiifJ2wiA1rvhyPjKrEzd:jRIPLbGe5dHH9ZJ6A1jhyPjKrwd
TLSH 50B4237841EF2BA066D758C6135ECF67DE25CDC0AE6259B0DC11CDA70C503CE6AB62B4
Reporter abuse_ch
Tags:NanoCore Outlook RAT xz


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: EUR01-HE1-obe.outbound.protection.outlook.com
Sending IP: 40.92.65.25
From: Farid Dehri <edenlabo@hotmail.com>
Subject: TR: AW:AW:AW: RFQ
Attachment: 202088466387467446477PRODUCTLIST.xz (contains "202088466387467446477PRODUCTLIST.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/562995f1a0726e871a099bab7e8a07da7a734fc7392741889375f02c2fa6046a/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-19 01:39:24 UTC
AV detection:
4 of 48 (8.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kyuzl4naojxiogqjtovx5cqh3j5hgt6hhetudcetoxycyl5garva._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/562995f1a0726e871a099bab7e8a07da7a734fc7392741889375f02c2fa6046a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

xz 562995f1a0726e871a099bab7e8a07da7a734fc7392741889375f02c2fa6046a

(this sample)

NanoCore

Executable exe 2035071dea13b48db2cc9248961f3f55a41e60b0b346f190a3a69b75670b99bc

  
Dropping
MD5 fc4c0e3c7fb2ca41665cdea1d0a70000
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2035071dea13b48db2cc9248961f3f55a41e60b0b346f190a3a69b75670b99bc

Comments