MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95b21c61aa96dea34b7db488b41c39c6b675f445e316424eb3f70873b7dc1e30. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 95b21c61aa96dea34b7db488b41c39c6b675f445e316424eb3f70873b7dc1e30
SHA3-384 hash: cc5e85d05948ff1c1eb3025e9faae13b262b6edff3e8f8992db547cd13d22ef6f2f67aff2f3c5d461cf7a6c0f767b7a9
SHA1 hash: 7afaed579f05fd2730521734eb09db6ba72a81d3
MD5 hash: d3a4e09fd26aca10b2c2a7a4318e5dc6
humanhash: bulldog-high-minnesota-lion
File name:new order is in the attached.r00
Download: download sample
Signature NanoCore
Create hunting rule
File size:610'149 bytes
First seen:2020-10-23 07:00:50 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:ps5zLlldaDwrkCa/Beq3mZLrK0AKIfvUvPZa8utumW6B0iNYDbL+4YPYCTx+2JyX:S5zLlnYmk6qcG0AKIogvFOHLBYgCTx+/
TLSH DBD4335F044CB46E451EF5B6DA887A24F27AD3131FBC3905BDC0FA3123A62784469DAE
Reporter abuse_ch
Tags:r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps.pantin-hoes.com
Sending IP: 45.95.169.163
From: Agnes.C <info@gehring-group.com>
Reply-To: info1@pantin-hoes.com
Subject: Re: Re: new order
Attachment: new order is in the attached.r00 (contains "new order is in the attached.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/95b21c61aa96dea34b7db488b41c39c6b675f445e316424eb3f70873b7dc1e30/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-10-23 06:38:05 UTC
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=swzbyynks3pkgs35wselihbzy23hl5cf4mleetvt64ehhn64dyya._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

r00 95b21c61aa96dea34b7db488b41c39c6b675f445e316424eb3f70873b7dc1e30

(this sample)

NanoCore

Executable exe be7cc0fc45907d943e22b276471d9bc141c58f7668d59e3faac24d52e2734576

  
Dropping
MD5 e85017de3454fc1b397d22c4e6b4aae6
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 be7cc0fc45907d943e22b276471d9bc141c58f7668d59e3faac24d52e2734576

Comments