MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 55e719d9b93567139ed676f4fd2af8ed3ca1ab85667d182f30d028cd3ad41104. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 55e719d9b93567139ed676f4fd2af8ed3ca1ab85667d182f30d028cd3ad41104
SHA3-384 hash: f77d976e2c4984ab9493a053ad41a5b377c4b2adbbc0456ac16501491d5562863f7e2db082121ee043a0e5a37e8fad47
SHA1 hash: 02fd0c6281ee6d42fe93168c4e8a6982d0a51605
MD5 hash: 4e3ab4dbf1b4fea0f7a188260a124428
humanhash: mike-arizona-november-zebra
File name:Order.r11
Download: download sample
Signature NanoCore
Create hunting rule
File size:296'590 bytes
First seen:2020-05-11 07:44:35 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:4/WXGzd26ZZXQGDkoeS7lmeqI21FKbM8npb54d8ZGurBobF:2d26ZNlNlmeqI218bM8dZT2Z
TLSH E65423EC6957BF40A5F935E2B173FA539837A5DA01398F0D8B3285CF5811D09262234F
Reporter abuse_ch
Tags:NanoCore r11 RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: vps.yidagnp.com
Sending IP: 45.95.169.73
From: HUAN, JINHAI <ju.yang@beaulieuasia.com>
Subject: Re: order
Attachment: Order.r11 (contains "Order.exe")

NanoCore RAT C2:
185.19.85.133:9995

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-12 02:55:00 UTC
File Type:
Binary (Archive)
Extracted files:
7
AV detection:
13 of 31 (41.94%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kxtrtwnzgvtrhhwwo32p2kxy5u6kdk4fmz6rqlzq2aum2owuceca._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 55e719d9b93567139ed676f4fd2af8ed3ca1ab85667d182f30d028cd3ad41104

(this sample)

NanoCore

Executable exe c43d85dc319a3e0e9faeb9aa8967ab597ce9c7d76d78ad5d7cea309b73a7b653

  
Dropping
MD5 77dcd9d7e5f3849d177ec4bf54e8be1d
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c43d85dc319a3e0e9faeb9aa8967ab597ce9c7d76d78ad5d7cea309b73a7b653

Comments