MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 639d059185e5be3d7f0501dbb2112bffe611078873d1bc41c44ca50eb2913a03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 639d059185e5be3d7f0501dbb2112bffe611078873d1bc41c44ca50eb2913a03
SHA3-384 hash: 6f733970103e0578bbc841b565e2c1da7f02e8067adfb07036da2593b7d30fe8230e81da08a23a1dbda816820d5fad64
SHA1 hash: 275c82e413f805c6b20c65361575d9f8359c60c4
MD5 hash: 78eb42d689e954676d2957213378e109
humanhash: michigan-sweet-coffee-echo
File name:Balance Payment.7z
Download: download sample
Signature NanoCore
Create hunting rule
File size:376'444 bytes
First seen:2021-10-07 10:29:57 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:+V0jazHymiua62MRyB/cwdkXa0KNoqg7uwuDaCFrjCZvLBIS6xIO087Pr:+V00HC1R3+W3FxwuDaCFwLBIZz
TLSH T1198423EEA5D99EBB6790ED30B1728E4A52D3710247E03A34D2CE7E18D0C95BD5C1272B
Reporter cocaman
Tags:7z NanoCore zip


Avatar
cocaman
Malicious email (T1566.001)
From: "commercial@bieco.com.tn" (likely spoofed)
Received: "from bieco.com.tn (unknown [37.0.10.22]) "
Date: "7 Oct 2021 03:23:32 -0700"
Subject: "Re: Balance Payment "
Attachment: "Balance Payment.7z"

Intelligence

File Origin
# of uploads :
1
# of downloads :
296
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_fs1698.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.PackedNET.935-1.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/615ecc2fb95458900cde080b/reports/a49a021e-08ed-4d7f-944a-252a0fd28e09/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/639d059185e5be3d7f0501dbb2112bffe611078873d1bc41c44ca50eb2913a03
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/639d059185e5be3d7f0501dbb2112bffe611078873d1bc41c44ca50eb2913a03/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-10-07 08:36:42 UTC
AV detection:
12 of 45 (26.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mooqlemf4w7d27yfahn3eejl77tbcb4iopi3yqoejssq5murhibq._file
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/211007-mjtrhacbh9/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
kamuchehddhgfgf.ddns.net:1187
37.0.10.22:1187
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Nanocore
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/639d059185e5be3d7f0501dbb2112bffe611078873d1bc41c44ca50eb2913a03

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip 639d059185e5be3d7f0501dbb2112bffe611078873d1bc41c44ca50eb2913a03

(this sample)

NanoCore

Executable exe e833e0cadc169f826504773c1fa084b972c4080dc6b4c4a2e562bc24af478b69

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 e833e0cadc169f826504773c1fa084b972c4080dc6b4c4a2e562bc24af478b69
  
Dropping
NanoCore

Comments