MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5c309ccc9f44f592df5a64e28b16419335dcde43e3802ba8eaba8af802f6099. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5c309ccc9f44f592df5a64e28b16419335dcde43e3802ba8eaba8af802f6099
SHA3-384 hash: 59f0ba5d147e6c15e563b1ae61cf099f72a30f5221be5fbace221858bcef54a5b29706df203c4f9bd32384961938d09c
SHA1 hash: 8ab8750c405194f8fe5a452e1ef4dbaf933b225d
MD5 hash: 86625c59dae023dd761ba4a3fbddd76e
humanhash: wisconsin-steak-wolfram-lactose
File name:VSI_202012223,pdf.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:643'522 bytes
First seen:2020-12-23 07:44:14 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:x6GdQburFsfF3TkTLgRa/YlVm/PPThGiidLqCLyIRaOvp20u:xD6KrFsN4TLgRawlVm/P7EiidUL/
TLSH D9D423E06D9A049D0D62C63C9F7FAB0C7964E96A519CB18BCC60EBC61D807C27E67D34
Reporter abuse_ch
Tags:zip


Avatar
abuse_ch
Malspam distributing unidentified malware:

HELO: vps.mogamour.com
Sending IP: 45.85.90.198
From: Raksha B R <sales@innosap.com>
Subject: Confirm stock/ Need PI -IMPORT ORDERS
Attachment: VSI_202012223,pdf.zip (contains "VSI_202012223,pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
439
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_badexts46.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.26176.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5c309ccc9f44f592df5a64e28b16419335dcde43e3802ba8eaba8af802f6099/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2020-12-23 07:45:07 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2xbqttgj6rhvslpvuzhcrmledezv3tpehy4afouovouk7abpmcmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/d5c309ccc9f44f592df5a64e28b16419335dcde43e3802ba8eaba8af802f6099

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip d5c309ccc9f44f592df5a64e28b16419335dcde43e3802ba8eaba8af802f6099

(this sample)

NanoCore

Executable exe 9a010009db0cef15b26b8c0698dcabc904aff124a484334bbba646c6f0a3084e

  
Dropping
MD5 4b90e3ef6a7b2625ff72b642916abac4
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9a010009db0cef15b26b8c0698dcabc904aff124a484334bbba646c6f0a3084e

Comments