MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a73ef7f3f6a1c5fc2eed4f2108e4e9b42afced361f2cfa107581396c65da6986. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a73ef7f3f6a1c5fc2eed4f2108e4e9b42afced361f2cfa107581396c65da6986
SHA3-384 hash: ff9a799545d90f21c441c3888ff2bdbed812db036ca6d74ae6777ad8ba2cd576213931b3db3d03f8e873b095f60327a6
SHA1 hash: 455acdfe770e8afd816eae350fc7096d31cea0f3
MD5 hash: e4b4eaad6d3a0af98f148e56776fea2a
humanhash: whiskey-burger-steak-washington
File name:New Order.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:448'594 bytes
First seen:2022-02-03 07:57:50 UTC
Last seen:2022-02-03 07:58:47 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:OpCO89WKEisF/ZXrL2DCj8fTSHFc5u+Zr6bDjgqsJwW6u1HF:OUO89WmsF/RrL2DI8fTSHOAGr6rg3yWh
TLSH T12F94233C6619CD7EC862218DBA258BF4F8C4251B79A357732E6037C9D4AD03F52B91E1
Reporter cocaman
Tags:zip


Avatar
cocaman
Malicious email (T1566.001)
From: "Ms.Linda Jorge<smile@datanorte.com.br>" (likely spoofed)
Received: "from datanorte.com.br (unknown [45.133.174.110]) "
Date: "02 Feb 2022 18:31:43 -0800"
Subject: "Re:New Order"
Attachment: "New Order.zip"

Intelligence

File Origin
# of uploads :
2
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe obfuscated packed
Link:
https://www.filescan.io/uploads/61fb8b1718d1bfdde4eecbcd/reports/88578015-9112-463b-b7a0-deea51415fcd/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/a73ef7f3f6a1c5fc2eed4f2108e4e9b42afced361f2cfa107581396c65da6986
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a73ef7f3f6a1c5fc2eed4f2108e4e9b42afced361f2cfa107581396c65da6986/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-03 02:24:24 UTC
File Type:
Binary (Archive)
Extracted files:
30
AV detection:
20 of 43 (46.51%)
Threat level:
  5/5
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220203-jtwr3aedcm/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
NanoCore
Malware Config
C2 Extraction:
mercydylan55.hopto.org:53409
194.5.98.33:53409
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a73ef7f3f6a1c5fc2eed4f2108e4e9b42afced361f2cfa107581396c65da6986

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip a73ef7f3f6a1c5fc2eed4f2108e4e9b42afced361f2cfa107581396c65da6986

(this sample)

NanoCore

Executable exe 868d9db859d2b642c25a7cf671cfe4a14b100f2c5fa9b1f2847b7ecf436700b9

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 868d9db859d2b642c25a7cf671cfe4a14b100f2c5fa9b1f2847b7ecf436700b9

Comments