MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6715246c4b5145fa255db50723b020e38822589c39b828cee690b3c614b20fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f6715246c4b5145fa255db50723b020e38822589c39b828cee690b3c614b20fd
SHA3-384 hash: 39701584170da2aa83371aaeda433ec52ebee90b0429aa30d9295f12bd460251a2852b9b361bd1f9b2d7ba2d0639bb22
SHA1 hash: 1b41079e1a0498e06b5db943c428db615970d264
MD5 hash: 86389082e595bf9f70a5cc8590e757db
humanhash: oven-echo-equal-five
File name:docscanner.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:251'181 bytes
First seen:2020-06-08 07:57:50 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:KasF2DOVIalY2hjdS68UIJwMV0baMrVuZ:wFwOU6UJn2bZq
TLSH A734239462D191379B8BC4A3608113CF46337875DCE6FDC5837B2AF145A86EC4E26E8C
Reporter abuse_ch
Tags:NanoCore rar RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: vps.brersont.com
Sending IP: 45.95.169.22
From: Edit tacksang <edit@tack-sang.com>
Subject: Re: RFQ: Treat as Priority
Attachment: docscanner.rar (contains "scan003.scr")

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Quasar
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 07:59:03 UTC
AV detection:
24 of 48 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=6zyverwewukf7isv3niheoycby4iejmjyonyfdhoneftyykled6q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar f6715246c4b5145fa255db50723b020e38822589c39b828cee690b3c614b20fd

(this sample)

NanoCore

Executable exe 122143663c7c3c1a476737764cb876845cdb9f98647c27af1a58f46942895d2f

  
Dropping
MD5 dddd37e34fdf1724519bbcef88f32903
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 122143663c7c3c1a476737764cb876845cdb9f98647c27af1a58f46942895d2f

Comments