MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fa32a3064a94a3110b8acda764a1c3ee510da0e8991c0d13ccb9b49dedc4f492. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fa32a3064a94a3110b8acda764a1c3ee510da0e8991c0d13ccb9b49dedc4f492
SHA3-384 hash: 10d438fdab4868affbff2ea5a424d96f20eecd823b4db86ef1dbfbdd4237af24f8fd3168d590bbea7b7a7a5ed095e054
SHA1 hash: 12ae862e8c965e7b963208fbe7f919f3fcc72049
MD5 hash: bb7de129e11fc4b183df2be13475db49
humanhash: alabama-alaska-mobile-beer
File name:RFQ CL-2021 - 0188 ROCKWELL LAND (WEVER).xls.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'032'809 bytes
First seen:2021-08-03 06:20:23 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:7lWYPeO5jeZxNfsILpEAS4nhKm7NvSAPRT+iExpT1t:xUO5jyNZBSAPV03D
TLSH T1A225330C39187D245910D776980FA7ABD1FC2F916A86EF4B2CB9ECDD2B48C4A153172B
Reporter cocaman
Tags:NanoCore zip


Avatar
cocaman
Malicious email (T1566.001)
From: ""Maricon Teodoro" <EXPRESS_ADG@ismarine.com.tr>" (likely spoofed)
Received: "from ismarine.com.tr (unknown [45.137.22.38]) "
Date: "03 Aug 2021 06:35:46 +0200"
Subject: "RFQ - ROCKWELL LAND "
Attachment: "RFQ CL-2021 - 0188 ROCKWELL LAND (WEVER).xls.zip"

Intelligence

File Origin
# of uploads :
1
# of downloads :
621
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Zip_xls.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.25511.ZipHeur.Ext.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/fa32a3064a94a3110b8acda764a1c3ee510da0e8991c0d13ccb9b49dedc4f492
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fa32a3064a94a3110b8acda764a1c3ee510da0e8991c0d13ccb9b49dedc4f492/
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2021-08-03 06:21:05 UTC
File Type:
Binary (Archive)
Extracted files:
18
AV detection:
15 of 46 (32.61%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7izkgbskssrrcc4kzwtwjiod5ziq3ihiteoa2e6mxg2j33oe6sja._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/210803-nprcdsmq42/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fa32a3064a94a3110b8acda764a1c3ee510da0e8991c0d13ccb9b49dedc4f492

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip fa32a3064a94a3110b8acda764a1c3ee510da0e8991c0d13ccb9b49dedc4f492

(this sample)

NanoCore

Executable exe 94dc3ceb75323f7b1bff7355da2d28804d4df36fa98a1335211101ef94bb2dda

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 94dc3ceb75323f7b1bff7355da2d28804d4df36fa98a1335211101ef94bb2dda

Comments