MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 741d99e06fa4a9e945cd70675fe8f28c9182e5ceae54e922fe94a59084007b0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 741d99e06fa4a9e945cd70675fe8f28c9182e5ceae54e922fe94a59084007b0b
SHA3-384 hash: 5c791c7156a21164a38191ee6631063a2347b85b8d20552a02d595337b1e6943ecb34cfb3ed7bfbe6af730d436facd0b
SHA1 hash: 6aeebff0c45104e7751cad36d7e603589cd4987f
MD5 hash: 384e341568fa67720edf18db9bb51337
humanhash: nine-green-arkansas-papa
File name:ACH.IMG
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-05 17:10:38 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:LP3SB7HdJqizbL9kmskNfjxx7VGVOpiRSUpxJFgrpiA:u7/XXxkMz7VCQmxYQA
TLSH C045E08437AD5BAAD9FC5BF4419C348007B87D5BAE11E3557EC830FA1333B448AA1A97
Reporter abuse_ch
Tags:img NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: server.amcham.or.id
Sending IP: 172.104.32.98
From: no-reply@amcham.or.id
Subject: Invoice Payment Confirmation
Attachment: ACH.IMG (contains "z2oO7PdSuSedF10.exe")

NanoCore RAT C2:
185.84.181.89:9083

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/741d99e06fa4a9e945cd70675fe8f28c9182e5ceae54e922fe94a59084007b0b/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-05 17:12:07 UTC
AV detection:
5 of 48 (10.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oqoztydpusu6sronobtv72hsrsiyfzoovzkosix6ssszbbaapmfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.45
Link:
https://yomi.yoroi.company/submissions/741d99e06fa4a9e945cd70675fe8f28c9182e5ceae54e922fe94a59084007b0b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

img 741d99e06fa4a9e945cd70675fe8f28c9182e5ceae54e922fe94a59084007b0b

(this sample)

NanoCore

Executable exe 82c3dd9e4b7e58fba6607bd562d4a80bc2c30f329bd7e7a5be3f40398b45caf1

  
Dropping
MD5 ba83069cf373373d35a107ac5d8b4da9
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 82c3dd9e4b7e58fba6607bd562d4a80bc2c30f329bd7e7a5be3f40398b45caf1

Comments