MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5dd2759b1e484729eba5cc169c775a5fa54ac226e5b3359ed681d2aa5c7acda. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5dd2759b1e484729eba5cc169c775a5fa54ac226e5b3359ed681d2aa5c7acda
SHA3-384 hash: cca95559d5b1d6aca5b4734a1891aaa9b7ea87141d5b8840f2e68041a7cb8917dfa880fc24b608c282af1c06163e66f1
SHA1 hash: ba14ba0f4ffd3570a6f75b02034a91c3df89f777
MD5 hash: 0fb5bac30f32e4686e1cd5233dabf831
humanhash: sierra-sink-magazine-oranges
File name:QUOTATION#031020_Vina_ak_Sales_Pvt_Ltd.arj
Download: download sample
Signature NanoCore
Create hunting rule
File size:620'163 bytes
First seen:2020-10-06 03:56:59 UTC
Last seen:2020-10-06 07:08:58 UTC
File type: arj
MIME type:application/x-rar
ssdeep 12288:KiJvPcRM+B71CTxqqCumGfXgGcNF6PfaH0bcrvAKKTqQZvm4vK0DOHa:LHcWptRJPBc36PfaH0bcDAKKTtvEzHa
TLSH FFD423C6CEF687316C2608B8C92D216104C542286AB6BB9F3E13ED0D4BED77B815D6E4
Reporter GovCERT_CH
Tags:NanoCore

Intelligence

File Origin
# of uploads :
2
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5dd2759b1e484729eba5cc169c775a5fa54ac226e5b3359ed681d2aa5c7acda/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-10-06 00:59:16 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yxosownr4schfhv2ltawtr3vux5fjlbcnzntgwpnnaosvjohvtna._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Nanocore
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c5dd2759b1e484729eba5cc169c775a5fa54ac226e5b3359ed681d2aa5c7acda

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

arj c5dd2759b1e484729eba5cc169c775a5fa54ac226e5b3359ed681d2aa5c7acda

(this sample)

NanoCore

Executable exe d9c78a21a8344b6cc4768d7fa1b9ff128437267f1b7d1d29fccca4a5751d7ed6

  
Dropped by
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d9c78a21a8344b6cc4768d7fa1b9ff128437267f1b7d1d29fccca4a5751d7ed6
  
Dropping
MD5 db7376dcd238c060d1f1569a1b1bbafd

Comments