MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a21fdd435ab804271decec7bb86aa1e3152f2ea7e5da0ff8b82737a8a7e9f613. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a21fdd435ab804271decec7bb86aa1e3152f2ea7e5da0ff8b82737a8a7e9f613
SHA3-384 hash: 5f5ce792eb961d3385a23b4e0dda7042bc9702e3d8f3e86d865a3d0000b4d52a0259faeeab32778137c62bb4cb79a15a
SHA1 hash: 326a03eb1c7548e3dda6e3f231158290f46cbe88
MD5 hash: 00707f9b1fc099f1117a844eac248c53
humanhash: twelve-winner-lithium-papa
File name:Shippment plan of October2020 pdf.gz
Download: download sample
Signature NanoCore
Create hunting rule
File size:458'932 bytes
First seen:2020-10-12 05:53:35 UTC
Last seen:Never
File type: gz
MIME type:application/gzip
ssdeep 12288:eLbbSCXz1m9KgqfhyOHkrYYASIzl4pxMT4gt7tEBqhz1a:eLbbSaz1YKlfhyOHk8YH8WpxMkgsBq14
TLSH 71A423AA8B7CBC6294377192F700E6D34167B4A0EC0D4BB3EC9265BB1F390DB4742596
Reporter abuse_ch
Tags:gz NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: server.devbox12.com
Sending IP: 162.249.2.44
From: CAO DUONG CO. LTD <narong@bpsiiw.com>
Reply-To: CAO DUONG CO. LTD <ricknicolas.aol@hotmail.com>, CAO DUONG CO. LTD <ricknicolas.aol@hotmail.com>
Subject: Revised Shipment Plan of Oct.(Oct. 2020)
Attachment: Shippment plan of October2020 pdf.gz (contains "Shippment plan of October2020 pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a21fdd435ab804271decec7bb86aa1e3152f2ea7e5da0ff8b82737a8a7e9f613/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=uip52q22xaccohpm5r53q2vb4mks6lvh4xna76fye432rj7j6yjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a21fdd435ab804271decec7bb86aa1e3152f2ea7e5da0ff8b82737a8a7e9f613

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

gz a21fdd435ab804271decec7bb86aa1e3152f2ea7e5da0ff8b82737a8a7e9f613

(this sample)

NanoCore

Executable exe 4c3a7099eda494c1353b5a682855c0bda954754a1d9afb8a89beca8df2f070ef

  
Dropping
MD5 4e880e268fa1fa3685b4d5a399950442
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4c3a7099eda494c1353b5a682855c0bda954754a1d9afb8a89beca8df2f070ef

Comments