MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 25df86b7c684a012d595c92c1d64e70c55ed4f94111f04194ae8b5fe5a151de9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 25df86b7c684a012d595c92c1d64e70c55ed4f94111f04194ae8b5fe5a151de9
SHA3-384 hash: 3669ebd3f3a477eb73b4a23196d3642334419caae23a36afb40b89d54da8326b1131cfb7b2711bad0a73795650db6f50
SHA1 hash: 63186071846d8c7e8e16b2ac73d9cd91a5096509
MD5 hash: 115fe24f67d8102e4479277169f14775
humanhash: eight-earth-kentucky-gee
File name:Logistics-04-08-2020.r11
Download: download sample
Signature NanoCore
Create hunting rule
File size:614'425 bytes
First seen:2020-08-05 06:35:09 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:y2KAH2QecYZ5QpHoadKZN6OxNlp1oxZfFfjFzRHEfIgZtepI/oK9Nrn4:yXAWQe5QpvdKZsOxNT1IFfp1uPo5
TLSH 82D423E698071B2EC548FEDFAD9B0B19352F237BD4C8D77E84B90718DC468423B62255
Reporter abuse_ch
Tags:Hostwinds NanoCore r11 RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: hwsrv-758891.hostwindsdns.com
Sending IP: 104.168.203.3
From: Alexandro Rodríguez <info@loburig.com>
Subject: RE: Egea Logistics/04.08.2020
Attachment: Logistics-04-08-2020.r11 (contains "Logistics-04-08-2020.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/25df86b7c684a012d595c92c1d64e70c55ed4f94111f04194ae8b5fe5a151de9/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 03:58:42 UTC
AV detection:
17 of 48 (35.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=expynn6gqsqbfvmvzewb2zhhbrk62t4ucepqigkk5c274wqvdxuq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/25df86b7c684a012d595c92c1d64e70c55ed4f94111f04194ae8b5fe5a151de9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 25df86b7c684a012d595c92c1d64e70c55ed4f94111f04194ae8b5fe5a151de9

(this sample)

NanoCore

Executable exe 515a2c1a3b19f636a6bf97af416d1d7c07e4780a51e4976e72bdb408f8379521

  
Dropping
MD5 ddd0c615e21a9afb14a82a9d1e3c21de
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 515a2c1a3b19f636a6bf97af416d1d7c07e4780a51e4976e72bdb408f8379521

Comments