MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c66148ce00b39c346662ffcfc1bf69583200f05fa56e227a67309c4f414710f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c66148ce00b39c346662ffcfc1bf69583200f05fa56e227a67309c4f414710f5
SHA3-384 hash: 4ba5694d1b3b29944ce25454d379613a54495de011f1f590a4940b5cc1f31527c7545d021e1b1e973c40cf0027ed18e5
SHA1 hash: e31e198967b7df1a3284a1006ad72630b4951423
MD5 hash: 9657b36541595395114789d674a14374
humanhash: edward-lithium-autumn-island
File name:DHL AWB TRACKING DETAIILS.PDF.z
Download: download sample
Signature NanoCore
Create hunting rule
File size:315'531 bytes
First seen:2020-10-12 06:18:43 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:rZbPR9M+IsZ3anpbXjuVLYGXRgbVGYDo9A3qaETJgF:1L7M0KxXjg9mbVGY9qm
TLSH 8D6423B658394A55B234F85BFCF87B026F15775FF23200A5E86849FF9048690AD3C4AE
Reporter abuse_ch
Tags:DHL NanoCore RAT z


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: server.zeeetrew.gq
Sending IP: 188.225.78.168
From: DHL OFFICE <dhl@zeeetrew.gq>
Subject: COMMERCIAL INVOICE AND BILL OF LANDING... 12/10/2020
Attachment: DHL AWB TRACKING DETAIILS.PDF.z (contains "DHL AWB TRACKING DETAIILS.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c66148ce00b39c346662ffcfc1bf69583200f05fa56e227a67309c4f414710f5/
Threat name:
ByteCode-MSIL.Trojan.Quasar
Create hunting rule
Status:
Malicious
First seen:
2020-10-12 03:25:02 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=yzqurtqawoodiztc77h4dp3jlazab4c7uvxce6thgcoe6qkhcd2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c66148ce00b39c346662ffcfc1bf69583200f05fa56e227a67309c4f414710f5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

z c66148ce00b39c346662ffcfc1bf69583200f05fa56e227a67309c4f414710f5

(this sample)

NanoCore

Executable exe 269c0be3dc659333fee54772b29e3f4accec61cb7e13fb9794f157858bcf5230

  
Dropping
MD5 47c45b4c27233da9cd608c754ae8b2e8
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 269c0be3dc659333fee54772b29e3f4accec61cb7e13fb9794f157858bcf5230

Comments