MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87a797ee14bbf4e7c88c623d456ce1324dace7337fc72c3e1f049a56f30a41c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87a797ee14bbf4e7c88c623d456ce1324dace7337fc72c3e1f049a56f30a41c2
SHA3-384 hash: 4141bef2319368dfa1da3fb132a38a3277ceab04b665766f85ee37fbdde7d4e8e09bc0ce61ca604d29e0d0a57701155a
SHA1 hash: 2b70ef1a96fcfa524d2897352ce2db2b9d040805
MD5 hash: e24758b3d9627d3c7b22e6ffd9d7f326
humanhash: uncle-triple-november-pasta
File name:YOUNG WOO TRADING - PO 00120320EX.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:470'851 bytes
First seen:2020-06-04 14:21:33 UTC
Last seen:2020-06-05 07:30:03 UTC
File type: rar
MIME type:application/x-rar
ssdeep 12288:P9inuqucbH9UcN2Zed0TerWEz5nWdr0lQCa4JtFf02hfMtD:PWH5ksSsHlQ28RtD
TLSH DBA4239FFD0F8131BBC10E4E3176726A826B0339211D1A3EC6C97355B785A6B2529B73
Reporter abuse_ch
Tags:NanoCore rar RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: [185.234.216.161]
Sending IP: 185.234.216.161
From: Micheal Lee <ywvn2@youngwookr.com>
Reply-To: YOUNG WOO TRADING CO., LTD <cshz58.newcomer@chinamail.com>
Subject: YOUNG WOO TRADING - Urgent PO_#00120320
Attachment: YOUNG WOO TRADING - PO 00120320EX.rar (contains "YOUNG WOO TRADING - PO #00120320EX.exe")

NanoCore RAT C2:
185.234.216.161:2094

Intelligence

File Origin
# of uploads :
2
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-06-04 14:36:09 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=q6tzp3quxp2opsemmi6uk3hbgjg2zzztp7dsypq7asnfn4ykihba._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 87a797ee14bbf4e7c88c623d456ce1324dace7337fc72c3e1f049a56f30a41c2

(this sample)

NanoCore

Executable exe ec89b2b660ea42254a90f3b045dc98bfe6d1733878bd39a2a7030d68de169859

  
Dropping
MD5 34b549041faf0dd0c585aac7bfc6f82b
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ec89b2b660ea42254a90f3b045dc98bfe6d1733878bd39a2a7030d68de169859

Comments