MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c9456a5e629e29d98cd0e348709cc5c1c4f90b739d9d0bfab5c42f332628eb23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c9456a5e629e29d98cd0e348709cc5c1c4f90b739d9d0bfab5c42f332628eb23
SHA3-384 hash: 05eae789abee6eb071e556d71629eac35b11062f975e7a6875ee7d52bdb13779fae956195ea555ea150ce694186c615c
SHA1 hash: e5ad0afbe3017ab5380bdc1c74cc954be91e9e7e
MD5 hash: c3003ccafae110cf0873270e4e196b09
humanhash: purple-carbon-purple-papa
File name:RFQ.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:603'840 bytes
First seen:2021-02-25 11:10:57 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:EFg69WN/DEZve80wNnOMS1KVm2B+dQQ+VFqkCJtO8SXayuItoS85:Cju2v95OMSSmW+jMFDYk8FTN
TLSH 3CD423D6D4D9CB45BD1D10AB6CAB388A17DEDA42B063CEF47FE0765B0112B4A80B149F
Reporter abuse_ch
Tags:rar


Avatar
abuse_ch
Malspam distributing unidentified malware:

From: Chai Yee Poh<info@bun.k-dns.nl>
Reply-To: seema@cosnas.in
Subject: PRICE LIST/QUOTATION!!!
Attachment: RFQ.rar (contains "RFQ.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
146
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c9456a5e629e29d98cd0e348709cc5c1c4f90b739d9d0bfab5c42f332628eb23/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-25 11:11:11 UTC
AV detection:
5 of 47 (10.64%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zfcwuxtctyu5tdgq4nehbhgfyhcpsc3ttwoqx6vvyqxtgjri5mrq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar c9456a5e629e29d98cd0e348709cc5c1c4f90b739d9d0bfab5c42f332628eb23

(this sample)

NanoCore

Executable exe 72f30e8884110e06b133ecabfdbf523aef8cc5533273aa3e12afee785a5a45bc

  
Dropping
MD5 6733e06c6be5ca14ffc33763202f53c8
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 72f30e8884110e06b133ecabfdbf523aef8cc5533273aa3e12afee785a5a45bc

Comments