MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9554943276aad56ac4ee7542baeaedb3b8fec0bbb24ab94145b3c185979eff96. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9554943276aad56ac4ee7542baeaedb3b8fec0bbb24ab94145b3c185979eff96
SHA3-384 hash: da791f7c37140e4aed1234d84cf996d5f73ca3d819e0863dd0da7e4d0b6bd6c19f72be75b113425e2df5c0986ea5ad0b
SHA1 hash: 4fa5e13fdbf3e6e84de55d5b5076b8dfcf3c7b07
MD5 hash: 4f41b060c73caf15b1f00a3bb80c8e69
humanhash: alpha-beer-eleven-spring
File name:JST-6329,pdf.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:319'872 bytes
First seen:2020-06-19 08:49:46 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:xKq4YKjmBh55GrPUNFArVKVcqndjjEkDHIsqJlXIQv83YTBbyMSb:xj4YKSBh55GIyWV98LrlIb
TLSH EE64231C75B834388F36FE7865180D2211A764CB819516C1865BFFD89A7B4F0EF78E8A
Reporter abuse_ch
Tags:geo NanoCore nVpn RAT THA zip


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: correo1-pro04.hpservidor.com
Sending IP: 69.167.175.227
From: Paweena Wichai <paweena.wichai@lifestyles.com>
Subject: ขอใบกำกับสินค้าสำหรับ JST-6329
Attachment: JST-6329,pdf.zip (contains "JST-6329,pdf.exe")

NanoCore RAT C2:
billionaire.ddns.net:3734 (79.134.225.122)

Pointing to nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Generic.mg.c1dd65dc9d8d1861.9824.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.26176.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Zmutzy
Create hunting rule
Status:
Malicious
First seen:
2020-06-19 08:51:03 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=svkjimtwvlkwvrhoovblv2xnwo4p5qf3wjflsqkfwpaylf4676la._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip 9554943276aad56ac4ee7542baeaedb3b8fec0bbb24ab94145b3c185979eff96

(this sample)

NanoCore

Executable exe 15f16edea0ca4f3b0a43c1b4e232a30294bd25c3f4971cdaccabcfda45dfa9c9

  
Dropping
MD5 fe897936a6b8dfaf212c73d37108a513
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 15f16edea0ca4f3b0a43c1b4e232a30294bd25c3f4971cdaccabcfda45dfa9c9

Comments