MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c88b2daa123796b6a7dbc8dc0d0476467e54deb0202443f5c1e96280c454ea9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c88b2daa123796b6a7dbc8dc0d0476467e54deb0202443f5c1e96280c454ea9
SHA3-384 hash: 9e4c65c08fd12057b73f06e96063859b14e79cbd9fafeb711bbcc0432677f9bd64bf1200fed9f1c3e86b874087d957cd
SHA1 hash: f099a81ba457e96652d9c80846aa55af6e2b05c7
MD5 hash: b87fbbe5a53a502c22513cc7472a1f77
humanhash: burger-beryllium-hotel-gee
File name:Ricevuta di notifica del corriere Pelican Express.r11
Download: download sample
Signature NanoCore
Create hunting rule
File size:374'350 bytes
First seen:2020-08-05 07:49:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:VINbL7ZAwdoDmBj5wRt0XWJ5zpoghTTvQfVkZMVXx9DOea4hDpHN:ybLQqBFwl/33akWVvDjpjN
TLSH 8B842389DE1B362179FC3A89598E62C3ECC347A2A649EF4094D63FF345861BC087E51D
Reporter abuse_ch
Tags:geo ITA NanoCore r11 RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

From: Corriere espresso Pelican <info@patgon-cl.com>
Subject: Ricevuta di notifica del corriere Pelican Express
Attachment: Ricevuta di notifica del corriere Pelican Express.r11 (contains "Ricevuta di notifica del corriere Pelican Express.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c88b2daa123796b6a7dbc8dc0d0476467e54deb0202443f5c1e96280c454ea9/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 07:51:06 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nselfwvben4ww2t5xsg4buchmrt6ktplaibeip24d2lcqdcfj2uq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6c88b2daa123796b6a7dbc8dc0d0476467e54deb0202443f5c1e96280c454ea9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 6c88b2daa123796b6a7dbc8dc0d0476467e54deb0202443f5c1e96280c454ea9

(this sample)

NanoCore

Executable exe 41a16c2fac901e39b8d73bd18aee3a42b510c0e5a7984bb139584299b7356d16

  
Dropping
MD5 b343187fe97a819309b12e5b87d595cf
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 41a16c2fac901e39b8d73bd18aee3a42b510c0e5a7984bb139584299b7356d16

Comments