MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bbc6e2c05b438d9e7ed3247e3dac058394787ef116aa163fdf7b4bc06b446f4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bbc6e2c05b438d9e7ed3247e3dac058394787ef116aa163fdf7b4bc06b446f4a
SHA3-384 hash: 64bcfdf2dcf2fd55716827ee7b54e6df054c3a664b4d575fd77f8a589081acab414e09561d73df31f7192ad356ce045b
SHA1 hash: 9d3918173e4c82d0b9677589b119725ecd8c8cc8
MD5 hash: bd9be2482afaf4d1446d72fe83587392
humanhash: glucose-timing-winner-charlie
File name:Purchase Order.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:535'690 bytes
First seen:2020-10-13 07:43:45 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:PW1lXIOX5uM0Kpwh7x+Bjoyx1KlcFVDis3ft:gJPiKOJlEDtft
TLSH CAB433A8CF4E6AC079E75C0DD678E8204E131AD6D7E4E84DC92D90E8FBB0D24656E234
Reporter abuse_ch
Tags:NanoCore rar RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: emirates.net.ae
Sending IP: 45.137.22.41
From: alsumood@emirates.net.ae
Subject: RE: New Order October H2005
Attachment: Purchase Order.rar (contains "Purchase Order.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bbc6e2c05b438d9e7ed3247e3dac058394787ef116aa163fdf7b4bc06b446f4a/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xpdofqc3iogz47wter7d3lafqokhq7xrc2vbmp67pnf4a22en5fa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/bbc6e2c05b438d9e7ed3247e3dac058394787ef116aa163fdf7b4bc06b446f4a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar bbc6e2c05b438d9e7ed3247e3dac058394787ef116aa163fdf7b4bc06b446f4a

(this sample)

NanoCore

Executable exe f421278f47d19d423deb950eb7dda7674fdfbd008e7ca3af783d79cde0b1738a

  
Dropping
MD5 2acf37552104b02a101ffc02cadceea4
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f421278f47d19d423deb950eb7dda7674fdfbd008e7ca3af783d79cde0b1738a

Comments