MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9480db36a22cb1e70343ad8487cdd76598dac175c35de5e872aab0d0a78b6840. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9480db36a22cb1e70343ad8487cdd76598dac175c35de5e872aab0d0a78b6840
SHA3-384 hash: 8af023b59b5024016da0ce08869a3178c9401a39802e53a923dafe46ba39ed61a7777341e8ae7392dd1771cccd41b710
SHA1 hash: 4e90cda48af3033d9f80996f3041c5a9e1698546
MD5 hash: e01144a335c11e2e594ea51c87fc42e6
humanhash: carolina-monkey-ink-romeo
File name:Doc.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'094'456 bytes
First seen:2021-01-19 07:23:12 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:JqeWjpNgWVP/bHreTjmmTHf9Zrpk8BZ9sYaea6gyDwVJ2:Injb/rKTCmbf9ZG87CTc82
TLSH 43353360F5F16066CBD06A6507A38A6837EBA9F3B9B3B3DED30D202248444D5D4E7C67
Reporter abuse_ch
Tags:NanoCore rar RAT Yahoo


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: sonic314-20.consmr.mail.gq1.yahoo.com
Sending IP: 98.137.69.83
From: Yahoo@automailnoreply <unimarkpharma@yahoo.com>
Subject: FYR for 5x40
Attachment: Doc.rar (contains "Doc.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.18244.19674.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9480db36a22cb1e70343ad8487cdd76598dac175c35de5e872aab0d0a78b6840/
Threat name:
ByteCode-MSIL.Trojan.Tnega
Create hunting rule
Status:
Malicious
First seen:
2021-01-19 07:24:12 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ssanwnvcfsy6oa2dvwciptoxmwmnvqlvyno6l2dsvkynbj4lnbaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9480db36a22cb1e70343ad8487cdd76598dac175c35de5e872aab0d0a78b6840

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 9480db36a22cb1e70343ad8487cdd76598dac175c35de5e872aab0d0a78b6840

(this sample)

NanoCore

Executable exe 799087f4f62932dbe6405946e5fc9215c9df899909c15f0c1d876ec28e9436b0

  
Dropping
MD5 c853495818db3fddf333ce3eaf5e6cc3
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 799087f4f62932dbe6405946e5fc9215c9df899909c15f0c1d876ec28e9436b0

Comments