MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5c767666c37b268479781ea3700234ba34341662c37008a7713ec57f976940b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5c767666c37b268479781ea3700234ba34341662c37008a7713ec57f976940b
SHA3-384 hash: a4b0c71eb1991c54541fc95b98813bdb422b3a862caeb70d3d839e2dc927100d2181ed3ca536e0588689679a2dbe80cf
SHA1 hash: 3a1a477bb9dd5ac1cbf80f847fb2a8e45d6aac3d
MD5 hash: f4e5778594a9543ed5601fb47c3fd700
humanhash: mango-two-green-south
File name:LOI.zip.lha
Download: download sample
Signature NanoCore
Create hunting rule
File size:363'465 bytes
First seen:2020-08-14 08:42:57 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:vmeG8OiDXFmbfitnOcWaewnPorJmDIApcgtTBbphOg8DImyRqjF5/wxlce75YBCA:vmeG8OiDXFSKVTWaeYCEI+9XmyRqjF5n
TLSH 997423147FB2277139CBF3D04226F3A867B3C49DF3A9955C1835B705062AA894BE724E
Reporter abuse_ch
Tags:lha NanoCore RAT Yahoo


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: sonic305-21.consmr.mail.sg3.yahoo.com
Sending IP: 106.10.241.84
From: Albert Zuzarte <aezuzarte@yahoo.co.in>
Reply-To: Albert Zuzarte <aezuzarte@yahoo.co.in>
Subject: LOI AND RFQ
Attachment: LOI.zip.lha (contains "LOI.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5c767666c37b268479781ea3700234ba34341662c37008a7713ec57f976940b/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 08:44:08 UTC
AV detection:
8 of 48 (16.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yxdwoztmg6zgqr4xqhvdoabdjorugqlgfq3qbctxcpwfp6lwsqfq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c5c767666c37b268479781ea3700234ba34341662c37008a7713ec57f976940b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip c5c767666c37b268479781ea3700234ba34341662c37008a7713ec57f976940b

(this sample)

NanoCore

Executable exe 16a89bdfcb47975f86cf09cca2ae8a67224cc37cfd69264f9a55feed1cc83c48

  
Dropping
MD5 5b8b40704f2fca5bf16e4fba4cb6990e
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 16a89bdfcb47975f86cf09cca2ae8a67224cc37cfd69264f9a55feed1cc83c48

Comments