MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee8c46367596e91ab823d0d17b94ffd7094c1f513f4ca75936036f4980421276. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee8c46367596e91ab823d0d17b94ffd7094c1f513f4ca75936036f4980421276
SHA3-384 hash: 41a9845d532831d75d40ab418240da1004e1db8499633acbe43fc0916c46bc3eb6b89a1560d961f08d378a15a6c32483
SHA1 hash: cbe102549d3e3b78faffa151b02f71c21c78be70
MD5 hash: d490159ddfb2b2a6c11890965aeedacf
humanhash: alanine-high-massachusetts-quebec
File name:RFQ _ Inquiry 215642.docx and Quotation Form.z
Download: download sample
Signature NanoCore
Create hunting rule
File size:510'427 bytes
First seen:2020-08-14 08:47:53 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:kSCVNJUs94zwh2LM2bKhoWZ3Bhh4mA8N3A9GuiS:khVNJ794zvL7Kh7Z3BhimB3wGc
TLSH 05B423E8236B01487798879BEAF5430D84E1A4EE149DC99D98D0D3D2FB406BE95F03DE
Reporter abuse_ch
Tags:Hostwinds NanoCore RAT z


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: hwsrv-762625.hostwindsdns.com
Sending IP: 104.168.242.71
From: CHRISTAL MS <tmemetal@singnet.com.sg>
Subject: RE: OFFER 215642
Attachment: RFQ _ Inquiry 215642.docx and Quotation Form.z (contains "RFQ#Inquiry 215642.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee8c46367596e91ab823d0d17b94ffd7094c1f513f4ca75936036f4980421276/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 08:49:07 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=52gemntvs3urvobd2dixxfh724euyh2rh5gkowjwanxutacccj3a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ee8c46367596e91ab823d0d17b94ffd7094c1f513f4ca75936036f4980421276

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

z ee8c46367596e91ab823d0d17b94ffd7094c1f513f4ca75936036f4980421276

(this sample)

NanoCore

Executable exe 7c1982f88aa59a9e220b92e280e4fe1d47ef06214aa5784572f688419e3e7ec4

  
Dropping
MD5 577af04414ea52d9d179b90bc48470a5
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7c1982f88aa59a9e220b92e280e4fe1d47ef06214aa5784572f688419e3e7ec4

Comments