MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff5b50189fc13c9674b69331515a1b30db95477d1e7d1e479aa75f811a227fbe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff5b50189fc13c9674b69331515a1b30db95477d1e7d1e479aa75f811a227fbe
SHA3-384 hash: b93a5a9171053abbcdbc764f5bb87fd942598e76520efa2fb352af9a3f1983f039ed400b70b8db13854b99b67b5af3e1
SHA1 hash: d12511294f0677bafa9fe194fff8303b5de73ca5
MD5 hash: d3fc4dca2b6907fd1ac4b7d2ff6f0e69
humanhash: blue-equal-foxtrot-bravo
File name:PROOF OF PAYMENT.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:597'217 bytes
First seen:2021-02-15 12:55:00 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:khayM0UhYY15vxSjSUNlBVbSWmXvhoGDp5iLLtgGNSCeKKC1NW:bZ0UhYKEWUNlBohzni6GReKKs8
TLSH 8BC4239E72785D0540947C5610E75089F0AF7B449F188EAF3ABFE183FAB5401EBE9983
Reporter cocaman
Tags:NanoCore rar


Avatar
cocaman
Malicious email (T1566.001)
From: ""Account Dept"<paymnet@protonmail.com>" (likely spoofed)
Received: "from ik1-434-49261.vs.sakura.ne.jp (ik1-434-49261.vs.sakura.ne.jp [133.125.33.15]) "
Date: "Sun, 14 Feb 2021 12:32:16 -0800"
Subject: "PROOF OF PAYMENT"
Attachment: "PROOF OF PAYMENT.rar"

Intelligence

File Origin
# of uploads :
1
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff5b50189fc13c9674b69331515a1b30db95477d1e7d1e479aa75f811a227fbe/
Threat name:
ByteCode-MSIL.Trojan.Malrep
Create hunting rule
Status:
Malicious
First seen:
2021-02-15 12:55:08 UTC
File Type:
Binary (Archive)
Extracted files:
38
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=75nvage7ye6jm5fwsmyvcwq3gdnzkr35dz6r4r42u5pycgrcp67a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ff5b50189fc13c9674b69331515a1b30db95477d1e7d1e479aa75f811a227fbe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar ff5b50189fc13c9674b69331515a1b30db95477d1e7d1e479aa75f811a227fbe

(this sample)

NanoCore

Executable exe 8c6515ea1d1dc1263f76e273d06eee09ce298ddaefa435b84bb6e5bc9b578da1

  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8c6515ea1d1dc1263f76e273d06eee09ce298ddaefa435b84bb6e5bc9b578da1
  
Dropping
NanoCore

Comments