MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6f6be6aaa756359325338b9b2b47bbd3b6d55125c678977409052c15bacade2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	a6f6be6aaa756359325338b9b2b47bbd3b6d55125c678977409052c15bacade2
SHA3-384 hash:	4d027f408044af4c7a60e03c89d82a06536bfb167213b13230dc9dee2f456f91d7c4bdf4d6bc0268937998ba9040942f
SHA1 hash:	24e6ba35ad3c4ec390801a11f0fa80e9b222d0ef
MD5 hash:	15e63d95b76b595d456b8998c3c71157
humanhash:	idaho-cardinal-steak-xray
File name:	DRT PO NUMBER FIS22050413.img
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	227'328 bytes
First seen:	2022-05-04 15:27:33 UTC
Last seen:	2022-05-04 15:28:16 UTC
File type:	img
MIME type:	application/x-iso9660-image
ssdeep	384:+m9k5vFE6dAlWo23le/RhFVeGLdNETT4k4g6tGocA04sQm6eS2KWVAvne3Me+aoe:+mOQ/R/VeRaje3EJGq+xP
TLSH	T12C243302257CA8C3F69C6C73A8DC975E1EE16C5C4676106DF24BB6E9D63F103E6212E2
TrID	99.6% (.NULL) null bytes (2048000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.ABR) Adobe PhotoShop Brush (1002/3) 0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter	cocaman
Tags:	img NanoCore RFQ

cocaman

Malicious email (T1566.001)
From: "CEO - Ahmed <info@q-nap.com>" (likely spoofed)
Received: "from q-nap.com (unknown [62.197.136.237]) "
Date: "4 May 2022 15:47:12 +0200"
Subject: "RFQ DRT CONTRACT"
Attachment: "DRT PO NUMBER FIS22050413.img"

Intelligence

File Origin

# of uploads :

# of downloads :

232

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.W32.AIDetectNet.01.21059.14974.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

obfuscated

Link:

https://www.filescan.io/uploads/62729b90d2a90e9f3a239cc5/reports/0db4ea2b-7611-4759-bcc4-b40edbf9b7ef/overview

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a6f6be6aaa756359325338b9b2b47bbd3b6d55125c678977409052c15bacade2/

Threat name:

ByteCode-MSIL.Trojan.Injuke

Status:

Malicious

First seen:

2022-05-04 14:55:47 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

15 of 41 (36.59%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=u33l42vkovrvsmsthc43fnd3xu5w2vislrtys52asbjmcw5mvxra._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a6f6be6aaa756359325338b9b2b47bbd3b6d55125c678977409052c15bacade2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_EXE_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:	Internal Research