MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 841266b227c0194fb7c3721d903bbfc8ef980eccab59bd8179d95f400e3deb8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 841266b227c0194fb7c3721d903bbfc8ef980eccab59bd8179d95f400e3deb8b
SHA3-384 hash: edcb11fd6beb1a575c9e97398da3a502ef69bf14d5d00785898aab28347b182525a260896d6db97ab2e18c328e77358e
SHA1 hash: b92a4c75d10c8a65c5a6a14b9d004ed0ddbe32d8
MD5 hash: f9c3bd3c4c8115de40c863f73fe2045c
humanhash: whiskey-sink-lithium-vermont
File name:PROOF OF PAYMENT.IMG
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'376'256 bytes
First seen:2021-02-15 12:54:13 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:KxfMNAGE3qOh/EcvseSdNZo9KDictCHTC0kX7qj8DBTuLTtuZTUJ:K9GVE3qOh/zxqG9lkCHo7qQtThZTU
TLSH B7554A22D192A608E0ED76B35B20D11D3653FCCE3DB5A12529C6367B9E7B61043B89F3
Reporter cocaman
Tags:img NanoCore


Avatar
cocaman
Malicious email (T1566.001)
From: ""Account Dept"<paymnet@protonmail.com>" (likely spoofed)
Received: "from ik1-434-49261.vs.sakura.ne.jp (ik1-434-49261.vs.sakura.ne.jp [133.125.33.15]) "
Date: "Sun, 14 Feb 2021 12:32:16 -0800"
Subject: "PROOF OF PAYMENT"
Attachment: "PROOF OF PAYMENT.IMG"

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Packed2.42845.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/841266b227c0194fb7c3721d903bbfc8ef980eccab59bd8179d95f400e3deb8b/
Threat name:
Win32.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2021-02-15 10:57:10 UTC
File Type:
Binary (Archive)
Extracted files:
38
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qqjgnmrhyamu7n6doiozao57zdxzqdwmvnm33alz3fpuadr55ofq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/841266b227c0194fb7c3721d903bbfc8ef980eccab59bd8179d95f400e3deb8b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

img 841266b227c0194fb7c3721d903bbfc8ef980eccab59bd8179d95f400e3deb8b

(this sample)

NanoCore

Executable exe 8c6515ea1d1dc1263f76e273d06eee09ce298ddaefa435b84bb6e5bc9b578da1

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8c6515ea1d1dc1263f76e273d06eee09ce298ddaefa435b84bb6e5bc9b578da1
  
Dropping
NanoCore

Comments