MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4ad3f395715452a984e318e5944a42c81f6e4fa0f285dae6f9191d69cefe33f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4ad3f395715452a984e318e5944a42c81f6e4fa0f285dae6f9191d69cefe33f
SHA3-384 hash: 80dabe8a83bddf0ff29c093cb962f0045fd9ae59181a229a5a16f4807adbbd5959323c2dd7206a6cf8cc810dd00a0ac2
SHA1 hash: 28caa19af8282e317ef3ea74cf338c70a6e87f7f
MD5 hash: fc872652da4534ecb1afc5f9ac23a75b
humanhash: gee-yankee-rugby-black
File name:Invoices 489.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:864'649 bytes
First seen:2020-10-19 06:22:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 24576:7Peygf1LR9yv5bk3MhkDDjQQVUQvhaF/I9:C1f1LRkv5g3RDwQV1vhI/I9
TLSH 3A05230C658F37D04AF8DD8E5E2D6D94CB9BD7118AE07CC4902D8E0E64AF80A25DDEB5
Reporter abuse_ch
Tags:NanoCore Outlook rar RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: APC01-SG2-obe.outbound.protection.outlook.com
Sending IP: 40.92.253.34
From: ccy Aaron <aaron.ccy@hotmail.com>
Subject: Re:Re: Outstanding Invoice For Payment
Attachment: Invoices 489.rar (contains "Invoices 489.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4ad3f395715452a984e318e5944a42c81f6e4fa0f285dae6f9191d69cefe33f/
Threat name:
ByteCode-MSIL.Trojan.Quasar
Create hunting rule
Status:
Malicious
First seen:
2020-10-18 17:13:50 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2swt6okxcvcsvgcogghfsrfefsa7nzh2b4uf3ltpsgi5nhhp4m7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d4ad3f395715452a984e318e5944a42c81f6e4fa0f285dae6f9191d69cefe33f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar d4ad3f395715452a984e318e5944a42c81f6e4fa0f285dae6f9191d69cefe33f

(this sample)

NanoCore

Executable exe dca205ee15b1128bf97fa8660ee3240f4283109cd8e4d4334c394766449b6e15

  
Dropping
MD5 9a9c82095877cf3e1a8c0781d945673e
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dca205ee15b1128bf97fa8660ee3240f4283109cd8e4d4334c394766449b6e15

Comments