MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad11eb29a08a4d668f6f170b94bfa6da52cd70fd7fd99f40ea2e04da349f92f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad11eb29a08a4d668f6f170b94bfa6da52cd70fd7fd99f40ea2e04da349f92f8
SHA3-384 hash: 59b8e6c27ffe92e2f7c0877c26e9107e33dce5c0a4fb19b6e7110c72cf1e3f015033087f6fc32ae36b5165fd83dfda6d
SHA1 hash: 626f09d8f735cbe05f58594b4c748abfbf4cc7e4
MD5 hash: 2db03b9491c95459fab990bbdd87e8c2
humanhash: magazine-papa-johnny-tennessee
File name:Claim 001 002.r00
Download: download sample
Signature NanoCore
Create hunting rule
File size:612'966 bytes
First seen:2020-10-23 06:26:05 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:Fy0RwHo5IE97loC1MGjWvmUsW6P0C9EdotooUqvWRTDn:F/xbX1MHuPW68eEd+ojq+Fn
TLSH AED42364B89E7E0C14DE6E556A394F3EE97D086F2374B5100B4B2C278A75E0FF227486
Reporter abuse_ch
Tags:NanoCore r00


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps.pantin-hoes.com
Sending IP: 45.95.169.163
From: Agnes.C <info@gehring-group.com>
Reply-To: info1@pantin-hoes.com
Subject: Current Complains with Order
Attachment: Claim 001 002.r00 (contains "Claim 001 & 002_pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27382.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad11eb29a08a4d668f6f170b94bfa6da52cd70fd7fd99f40ea2e04da349f92f8/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-10-22 22:16:32 UTC
AV detection:
19 of 29 (65.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vui6wknarjgwnd3pc4fzjp5g3jjm24h5p7mz6qhkfycnune7sl4a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

r00 ad11eb29a08a4d668f6f170b94bfa6da52cd70fd7fd99f40ea2e04da349f92f8

(this sample)

NanoCore

Executable exe 4c2aa09b29e9a5245bdc62241d4170f8a99dc8d2c0822985f00fc6ca26652d1c

  
Dropping
MD5 f518df6c3a7a8f5cd302bec4bfaec621
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4c2aa09b29e9a5245bdc62241d4170f8a99dc8d2c0822985f00fc6ca26652d1c

Comments