MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 80bd61ab8dba2ca3869f76001ce013601c3710ea6ef0ffe0e1bd6bcc54bc13f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 80bd61ab8dba2ca3869f76001ce013601c3710ea6ef0ffe0e1bd6bcc54bc13f8
SHA3-384 hash: eeb2d86cb524d99c4c24d2e2a50ee7781b68343529597c61b03269050abc1a4924c037a5e65a9a4695d3d1b824cfdb64
SHA1 hash: e1aed6aae4339756db3bc7886aaa8da8760ed384
MD5 hash: 0bdde4c616dabac2412c2f1d4c94d5b8
humanhash: freddie-timing-friend-wisconsin
File name:RFQ-P.O DETAIL PRICE PER MTR .rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:476'994 bytes
First seen:2020-08-13 06:36:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:UVHbGkoNkHaDnJtI+bwGWlamXgdUUv3KWe:U1loNkkA+sGQaHVJe
TLSH 8FA4235F3AE8D0F2084A86D7632A7175BD18F58F337B5AE5242E6C4671082EDD4263BC
Reporter abuse_ch
Tags:NanoCore rar RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: gmail.com
Sending IP: 81.171.9.143
From: Ramya <chomi0605@panpacific.co.kr>
Reply-To: Ramya <surnit9041@gmail.com>
Subject: RFQ-P.O DETAIL PRICE PER MTR
Attachment: RFQ-P.O DETAIL PRICE PER MTR .rar (contains "RFQ-P.O DETAIL PRICE PER MTR .exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/80bd61ab8dba2ca3869f76001ce013601c3710ea6ef0ffe0e1bd6bcc54bc13f8/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 06:38:06 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qc6wdk4nxiwkhbu7oyabzyatmaodoehkn3yp7yhbxvv4yvf4cp4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/80bd61ab8dba2ca3869f76001ce013601c3710ea6ef0ffe0e1bd6bcc54bc13f8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 80bd61ab8dba2ca3869f76001ce013601c3710ea6ef0ffe0e1bd6bcc54bc13f8

(this sample)

NanoCore

Executable exe 1a5a50f2ed013719d08a9eb60588a626aa6e0e58762ce7721dfbdc56e968c63c

  
Dropping
MD5 5ef25cdfe80cee4665368d6465f4d73f
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1a5a50f2ed013719d08a9eb60588a626aa6e0e58762ce7721dfbdc56e968c63c

Comments