MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ab2cbe04f89cef566963d08f220a202c2b2c57ac1b3e716cb4b4144a3ea967a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ab2cbe04f89cef566963d08f220a202c2b2c57ac1b3e716cb4b4144a3ea967a
SHA3-384 hash: 77e1c597944160cdaf0b6e7cdaf1325b9354d42f32b6bbe49211ade90e52c042582649842ebd1e1ef543c5e26df132ef
SHA1 hash: 8accfc71076566397e2dfe43625e9f16ab4dd201
MD5 hash: 2c80968bb3845a528302fce486074800
humanhash: autumn-quiet-four-cardinal
File name:PURCHASE ORDER.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:197'456 bytes
First seen:2020-10-27 12:50:33 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 3072:VZCR2+Tp7/aAXdCbOeoFUv/l+LiEWVPNqALdAPqkRZnC7LCa/Di:Xat7acMOXFUXKVeN92vRZC/u
TLSH 9F1413E605C08FCA56D1273894EF4DF317329DBE913627C87E1D82A56D214D0C5A9377
Reporter abuse_ch
Tags:NanoCore rar RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: cloud-linux-07.chaiyohosting.com
Sending IP: 202.43.45.171
From: powersolutions <powersolutions@dynexsemi.com>
Subject: INQUIRY FOR NEW PURCHASE ORDER (URGENT!)
Attachment: PURCHASE ORDER.rar (contains "PURCHASE ORDER.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.21777.RarHeur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6ab2cbe04f89cef566963d08f220a202c2b2c57ac1b3e716cb4b4144a3ea967a/
Threat name:
Win32.Trojan.Skeeyah
Create hunting rule
Status:
Malicious
First seen:
2020-10-27 09:45:42 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nkzmxycprhhpkzuwhuepeifcalblfrl2ygz6ofwljnauji7ksz5a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Nanocore
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6ab2cbe04f89cef566963d08f220a202c2b2c57ac1b3e716cb4b4144a3ea967a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 6ab2cbe04f89cef566963d08f220a202c2b2c57ac1b3e716cb4b4144a3ea967a

(this sample)

NanoCore

Executable exe 4610679e66c4bc8abdad4a742823ff3809de1fe5d4a983bbb0dd4eec02136a94

  
Dropping
MD5 152bb0de36d69e13b7e803e9a637b132
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4610679e66c4bc8abdad4a742823ff3809de1fe5d4a983bbb0dd4eec02136a94

Comments