MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b4c0aab2b3426230f77ab94d4ae6346373062302a6fddb776dc12420aabf2713. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b4c0aab2b3426230f77ab94d4ae6346373062302a6fddb776dc12420aabf2713
SHA3-384 hash: c1a2f786d1504f91d52be75e3a65800cb7e513ec37f0af5732e7216b0b703a42b6d1b7dad2c5fdbac2e9aabb6c382fd1
SHA1 hash: 74f0a3adad2bd453a24ace23618da5bded49b9c1
MD5 hash: 53cc408a855d0f7c1895a64e024ace61
humanhash: south-mango-oklahoma-michigan
File name:Listed Items.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:603'955 bytes
First seen:2020-10-09 09:08:50 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:cNqMZd+mKiO/dwf2gBjteVz0nTMCdz17OH/NVuc6qTNtgkobDAnxwQ:EVA/ef2uuz0TVKH1VucTf
TLSH C8D433C1CD1BE68EFFBA701595C9EF494755898AB81C41B4D031E2804AAD260BFD2DFB
Reporter abuse_ch
Tags:NanoCore rar RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: server-solution.cf
Sending IP: 104.168.165.203
From: Manager <matt@greenwest.net.au>
Subject: Enquiry for POTWORDWIDE
Attachment: Listed Items.rar (contains "I6sSftkh08BcVNE.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b4c0aab2b3426230f77ab94d4ae6346373062302a6fddb776dc12420aabf2713/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 07:40:12 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wtakvmvtijrdb532xfguvzrumnzqmiycu365w53nyescbkv7e4jq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b4c0aab2b3426230f77ab94d4ae6346373062302a6fddb776dc12420aabf2713

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar b4c0aab2b3426230f77ab94d4ae6346373062302a6fddb776dc12420aabf2713

(this sample)

NanoCore

Executable exe a041901d7e7a00b59fb1c4a4e1b2cdb7e9acd7c554d0a13412e658cb42cf0d5b

  
Dropping
MD5 d79ef230c315ac078d0c9723e795cf7e
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a041901d7e7a00b59fb1c4a4e1b2cdb7e9acd7c554d0a13412e658cb42cf0d5b

Comments