MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba943c3c495e0a6590b1b136a8e0a30ffba173d6f28b38784120534942b39183. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ba943c3c495e0a6590b1b136a8e0a30ffba173d6f28b38784120534942b39183
SHA3-384 hash: 85c30fb5160ea9bfba9ab502d3e4d7c7bf6646b16ff5596c8e4004db9262fb74ab9cd907535852f7b2d245234d255fa7
SHA1 hash: e253c70bd4d3d9e5d28c85f98a5c95c17c04e964
MD5 hash: 312ade9389f89255bbb918e4b9b797bb
humanhash: green-fanta-single-neptune
File name:RFQ-PO #50763.z
Download: download sample
Signature NanoCore
Create hunting rule
File size:942'743 bytes
First seen:2020-08-20 05:31:57 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 24576:rxAHJFeAoAj7A82n9ft0bAU629ogZz94uAhXONuBt6+:rxyFeAo27A8q0DC6z9B0Cu6+
TLSH DE1533C7F3B6004413CD78C73882267B46DA19AF5ABB98101D874D65FAF7290FA9A0DD
Reporter cocaman
Tags:NanoCore z


Avatar
cocaman
Malicious email
From: "Danh Bopha" <info@daunpenh.com>
Received: from janna.com (unknown [45.127.62.42])
Date: Wed, 19 Aug 2020 22:07:43 +0200
Subject: URGENT RFQ-PO #50763
Attachment: RFQ-PO #50763.z

Intelligence

File Origin
# of uploads :
1
# of downloads :
131
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ba943c3c495e0a6590b1b136a8e0a30ffba173d6f28b38784120534942b39183/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-20 03:53:08 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xkkdypcjlyfglefrwe3kryfdb752c46w6kftq6cbebjusqvtsgbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ba943c3c495e0a6590b1b136a8e0a30ffba173d6f28b38784120534942b39183

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

z ba943c3c495e0a6590b1b136a8e0a30ffba173d6f28b38784120534942b39183

(this sample)

NanoCore

Executable exe ff83ce74018d4471c4cfffe406767fcd0db3ae76233e199fb3e3f5c0a40f7643

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ff83ce74018d4471c4cfffe406767fcd0db3ae76233e199fb3e3f5c0a40f7643
  
Dropping
NanoCore

Comments