MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58520300a96381c2943219d0b34248117a9083914111573d917720c98725e267. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58520300a96381c2943219d0b34248117a9083914111573d917720c98725e267
SHA3-384 hash: 0177e6fc95cf44db9b3bd89e5a7ea6f4a549a1110655e7533eec23c9ad975043f27ab912171b1ec674ff26f26fae05bf
SHA1 hash: add461a023fb42f256048fdfe961674da20e1d30
MD5 hash: 6b9b117eef704f905aa104769ce006fe
humanhash: magnesium-sink-seven-cola
File name:DECEMBER QUOTATION REQUEST FOR FR12007POH0008_PO0000143_ETQ.uu
Download: download sample
Signature NanoCore
Create hunting rule
File size:883'271 bytes
First seen:2020-12-19 06:59:48 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:PE/jnvLsoHT0doctkpOq+RJMvDaUNZ0rDfhdRw8rmg0V5IuiZkrN03XyKLXNq3th:0vLzciNhNZ0/fRl0V5IBCOHdQuPCvum
TLSH 8615334C18A1D339E6DAA033E123E16489AB77BF1D551C6ED77D784318CB8E16812CEE
Reporter abuse_ch
Tags:NanoCore uu


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: host.usabestserver.com
Sending IP: 162.214.72.205
From: sales_vic@charmedleather.com
Subject: QUOTATION REQUEST
Attachment: DECEMBER QUOTATION REQUEST FOR FR12007POH0008_PO0000143_ETQ.uu (contains "DECEMBER QUOTATION REQUEST FOR FR12007POH0008_PO0000143_ETQ.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
300
Origin country :
n/a
Vendor Threat Intelligence
Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58520300a96381c2943219d0b34248117a9083914111573d917720c98725e267/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lbjagafjmoa4ffbsdhilgqsicf5jba4rieivopmro4qmtbzf4jtq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/58520300a96381c2943219d0b34248117a9083914111573d917720c98725e267

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 58520300a96381c2943219d0b34248117a9083914111573d917720c98725e267

(this sample)

NanoCore

Executable exe c92c63658f161a639482f7e150303a4c6648f9186a8601fff6d14af694815895

  
Dropping
MD5 bebb73849224c7f6bde59b08d46a1c14
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c92c63658f161a639482f7e150303a4c6648f9186a8601fff6d14af694815895

Comments