MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62a4f4186a5dc3fb9fe597b1cf6f31ef8a5d0d831c3154ef2b40cc9fef6240f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 62a4f4186a5dc3fb9fe597b1cf6f31ef8a5d0d831c3154ef2b40cc9fef6240f5
SHA3-384 hash: a8f9f09be18bc8226c9769fc4bba131668ab6a5285c17b1ac667f6c6e0a58e1f37281a20c0325d94d31ccc22d99e6292
SHA1 hash: 08c3e5aee6576e1a934a6c6e246c509dc94462d6
MD5 hash: b4f39d9a3b1ab68ece81ecac56577ca0
humanhash: charlie-carpet-south-ack
File name:scanned copy.img
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'376'256 bytes
First seen:2022-07-19 16:14:56 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:C6M8NCWb2gb3IU3SSfYwfvLb6w0iMx1LrG4YVh3CVJn+Nqd9Fj72aFlSNSg3:CWsO9hwo/6w0HHyl4V9+K9FeaQSg3
TLSH T1455512123B909228CABF0F7BA932D51087B6BF623121D64F7E8C171D2F637468751B5A
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter cocaman
Tags:img NanoCore payment


Avatar
cocaman
Malicious email (T1566.001)
From: "Tasneem Suratwala <admin@ajmera.net>" (likely spoofed)
Received: "from grupoticomotor.com (unknown [141.98.6.128]) "
Date: "19 Jul 2022 07:59:59 -0700"
Subject: "RE: IMG and Advance payment acknowledgement- Ajmera 5000 Nos.1804055901"
Attachment: "scanned copy.img"

Intelligence

File Origin
# of uploads :
1
# of downloads :
207
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1756.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/62d6d9000e298a94f3decee2/reports/1688df38-2e3b-4322-ae37-f14ec6a3c568/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/62a4f4186a5dc3fb9fe597b1cf6f31ef8a5d0d831c3154ef2b40cc9fef6240f5/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2022-07-19 16:15:09 UTC
File Type:
Binary (Archive)
Extracted files:
57
AV detection:
8 of 40 (20.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mkspigdklxb7xh7fs6y463zr56ff2dmddqyvj3zlidgj733cid2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/62a4f4186a5dc3fb9fe597b1cf6f31ef8a5d0d831c3154ef2b40cc9fef6240f5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

img 62a4f4186a5dc3fb9fe597b1cf6f31ef8a5d0d831c3154ef2b40cc9fef6240f5

(this sample)

NanoCore

Executable exe d58c596621fcf7fe0514c4272a3567f427ab4392ce44febbb887b1bdecbe74fe

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d58c596621fcf7fe0514c4272a3567f427ab4392ce44febbb887b1bdecbe74fe
  
Dropping
NanoCore
  
Dropping
MD5 91bf22bca1ca8594ae2c1d74bf81e879

Comments