MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a95356c69ba9c27e2f39a118c84ae46eee15b20241ef95d052f7ab78b9e0332d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a95356c69ba9c27e2f39a118c84ae46eee15b20241ef95d052f7ab78b9e0332d
SHA3-384 hash: b6631aaa32074e1477f18fb5533e12375503bd428b6b257e94038a5a276b5891879262cf57c12a993de4d6889222942a
SHA1 hash: 401ac47ecb6675bce8edad63f65bc3d8dfd30e8a
MD5 hash: 844ba83e257703052abaf79be8568577
humanhash: two-oregon-nuts-delaware
File name:DHL_document1102202068090891.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:534'703 bytes
First seen:2021-03-05 12:58:42 UTC
Last seen:2021-03-10 00:56:40 UTC
File type: zip
MIME type:application/zip
ssdeep 12288:7i0NUKjyehSCylMQhHtnvmAXBKoUko95rzptG:79ZwhljXBKoUf/pM
TLSH 82B423896630ED46AF00358D8F7850DEE498149FB5A7FDB4DCEBCAA0C1AEC35049D746
Reporter GovCERT_CH
Tags:NanoCore

Intelligence

File Origin
# of uploads :
11
# of downloads :
260
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.36445262.14939.23502.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a95356c69ba9c27e2f39a118c84ae46eee15b20241ef95d052f7ab78b9e0332d/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-03-05 04:44:30 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vfjvnru3vhbh4lzzuemmqsxen3xblmqcihxzlucs66vxropagmwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/a95356c69ba9c27e2f39a118c84ae46eee15b20241ef95d052f7ab78b9e0332d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip a95356c69ba9c27e2f39a118c84ae46eee15b20241ef95d052f7ab78b9e0332d

(this sample)

NanoCore

Executable exe 29e3b512d05daef6e452885c14d65ef157ba20fb7b273b4c1aa5b74867563c9f

  
Dropped by
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 29e3b512d05daef6e452885c14d65ef157ba20fb7b273b4c1aa5b74867563c9f
  
Dropping
MD5 0b27c80ef94df6cf1299d2361f60852b

Comments