MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9fce2914755aae65de6c6897837a74c849afc036b8ed80b81755d986513f931c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9fce2914755aae65de6c6897837a74c849afc036b8ed80b81755d986513f931c
SHA3-384 hash: fe53c38ba7b68843734756ac313848cfa1e91b305b9b1edd0690a5188fcdcb379e832959c76e18d219c888df1a773700
SHA1 hash: 7700573fc8f04ff19cfa4781b086548615559de9
MD5 hash: c8b636bb0d9e5b201b6dccc55f24c3c0
humanhash: mexico-arizona-louisiana-yankee
File name:arrival notice-ETA 10th-11,2020.r15
Download: download sample
Signature NanoCore
Create hunting rule
File size:223'147 bytes
First seen:2020-11-03 11:10:13 UTC
Last seen:2020-11-03 14:29:16 UTC
File type: rar
MIME type:application/x-rar
ssdeep 6144:ijEHGNMQmM6d14uspDg7rByAPPBgUzF78Y2R:ijKnxdG9glKU2b
TLSH ED2423F60714F2E601B469A3E6CBA45EB351DA8CFFF580E031D152D8C5A22D52C3A9E6
Reporter cocaman
Tags:NanoCore r15


Avatar
cocaman
Malicious email (T1566.001)
From: "mohammed.ali@algharshobgroup.com"
Received: "from algharshobgroup.com (unknown [103.153.78.33]) "
Date: "3 Nov 2020 03:28:34 -0800"
Subject: "ARRIVAL NOTICE & INVOICE ETA 10th NOV 2020"
Attachment: "arrival notice-ETA 10th-11,2020.r15"

Intelligence

File Origin
# of uploads :
2
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9fce2914755aae65de6c6897837a74c849afc036b8ed80b81755d986513f931c/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-11-03 11:12:07 UTC
File Type:
Binary (Archive)
Extracted files:
38
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t7hcsfdvlkxglxtmnclyg6tuzbe27qbwxdwyboaxkxmymuj7smoa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9fce2914755aae65de6c6897837a74c849afc036b8ed80b81755d986513f931c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 9fce2914755aae65de6c6897837a74c849afc036b8ed80b81755d986513f931c

(this sample)

NanoCore

Executable exe 3fd371ac45f0ccc9b1902f841c9d644d972857def81521ee8562b8146b15411f

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3fd371ac45f0ccc9b1902f841c9d644d972857def81521ee8562b8146b15411f
  
Dropping
NanoCore

Comments