MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fc5ca223e071b86702a8d1c7d263218f84b325cac58dcebe45e693b971be8eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fc5ca223e071b86702a8d1c7d263218f84b325cac58dcebe45e693b971be8eb
SHA3-384 hash: fd74bb8530707a28372e057caa31edf4de2cd482f67a792743190826c8a6369e2f3b4db70dc071b7a7e5fd268f08467a
SHA1 hash: e19c46753ab40c9450e36913730d174313efc87b
MD5 hash: a78973176c0689f68de27593aa9a7001
humanhash: summer-robert-california-island
File name:relief filling.pdf.z
Download: download sample
Signature NanoCore
Create hunting rule
File size:224'973 bytes
First seen:2020-07-29 12:41:23 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:jws+/5k2fkY7q1oMkvq82jDzs/8GnYZN5Xn:UH/aJY7ioF2j8/8f1n
TLSH 8624126B072451D4ADC1CE0F5E2CEE3FD4872288513D6EAD260A0F1E56B53D9E928CED
Reporter cocaman
Tags:NanoCore z


Avatar
cocaman
Malicious email
From: IRS <terry@irs.relief>
Received: from server1.englam.com.sg (server1.englam.com.sg [103.11.189.83])
Date: Wed, 29 Jul 2020 12:21:01 +0000
Subject: filing and payment relief
Attachment: relief filling.pdf.z

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5fc5ca223e071b86702a8d1c7d263218f84b325cac58dcebe45e693b971be8eb/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-07-29 12:43:04 UTC
File Type:
Binary (Archive)
Extracted files:
47
AV detection:
18 of 29 (62.07%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l7c4uir6a4nym4bkruoh2jrsdd4ewms4vrmnz27elzutxfy35dvq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5fc5ca223e071b86702a8d1c7d263218f84b325cac58dcebe45e693b971be8eb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

z 5fc5ca223e071b86702a8d1c7d263218f84b325cac58dcebe45e693b971be8eb

(this sample)

NanoCore

Executable exe 013e28fb236b074fae60d3252c602924a886ad4c311310dbb19f85ba1c5e2425

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 013e28fb236b074fae60d3252c602924a886ad4c311310dbb19f85ba1c5e2425

Comments