MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd6f5c43408cd464c375d1b5092f5e2321b559df32ffe19b91520b88d95e8a64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd6f5c43408cd464c375d1b5092f5e2321b559df32ffe19b91520b88d95e8a64
SHA3-384 hash: f28e7fbc3bfb5828536530f78de8be7ca685e111d5318e13a0f6023e0dbcc84a304f36c53091057b0311ed12574c1cf0
SHA1 hash: 5f2d2c17dc01b29731d39e69556a615361544905
MD5 hash: 0c7c3f923a523a60f3ac1d7a9d88a8c4
humanhash: speaker-michigan-orange-cold
File name:Transfer Form.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:317'036 bytes
First seen:2020-08-14 10:13:31 UTC
Last seen:2020-08-14 14:09:58 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:o+okPJOHGq3RF4lQhNrmQjmODvaSFKPYY44gE+F9RhU1uS5FVrhbc+d:o9mMF4GhNHCwvaSFK+dNZU1h5G+d
TLSH 0764233D115F2631F06BB66AD407CE7F3593113B6B572B9945DACA8229BF83E24841A0
Reporter abuse_ch
Tags:NanoCore RAT zip


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: mib.com.mv
Sending IP: 37.48.85.242
From: "tradefinance@mib.com.mv" <tradefinance@mib.com.mv>
Subject: TT
Attachment: Transfer Form.zip (contains "Transfer Form.exe")

Intelligence

File Origin
# of uploads :
3
# of downloads :
112
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.276.20404.29277.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd6f5c43408cd464c375d1b5092f5e2321b559df32ffe19b91520b88d95e8a64/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 07:33:26 UTC
File Type:
Binary (Archive)
Extracted files:
23
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3vxvyq2artkgjq3v2g2qsl26emq3kwo7gl76dg4rkifyrwk6rjsa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dd6f5c43408cd464c375d1b5092f5e2321b559df32ffe19b91520b88d95e8a64

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip dd6f5c43408cd464c375d1b5092f5e2321b559df32ffe19b91520b88d95e8a64

(this sample)

NanoCore

Executable exe b008ed360af03c8b5f1a31bad43238507f56e73a546109d66349cc6638cb406f

  
Dropping
MD5 407e8450b1f6d59841eaa47a63d2466a
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b008ed360af03c8b5f1a31bad43238507f56e73a546109d66349cc6638cb406f

Comments