MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b12d23e2ebb552bcc7a40011b72895f11c30bac92f745c2598904200b48f6e75. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b12d23e2ebb552bcc7a40011b72895f11c30bac92f745c2598904200b48f6e75
SHA3-384 hash: e2665dc1e979f3b126bef4f957aec57a2fb3adbd69b4dec22a750516c069b7819a6f71ebb4591d84e6b8aa2a7ee4bcf0
SHA1 hash: 8031d9a3e79f686116cc2f9e956c25a8e97c48d7
MD5 hash: 381cbcd693ad6fe9f3a59b88a26eee7a
humanhash: victor-michigan-louisiana-jig
File name:SotaiyoGroup-RFQ20200701.xz
Download: download sample
Signature NanoCore
Create hunting rule
File size:302'309 bytes
First seen:2020-06-30 13:13:09 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 6144:tcljZkeevFFeRmo/zTDYemcqe3ypL4Tj0Qz0X7KnB:CZjWFepPDPmcB3oL4T2enB
TLSH 365423B99B79D108C8C5B3C7A3C6A516236731B359DE84400BAF5BC969DCFD296200BE
Reporter abuse_ch
Tags:NanoCore nVpn Outlook RAT xz


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: NAM11-DM6-obe.outbound.protection.outlook.com
Sending IP: 40.92.19.32
From: susana_figueirinha@hotmail.com
Reply-To: vojtech.tydlacka@yandex.com
Subject: Early July Supply order request..
Attachment: SotaiyoGroup-RFQ20200701.xz (contains "7DcshRRKyE3bON7.exe")

NanoCore RAT C2:
nobiwideget.dvrdns.org:54001 (5.206.224.136)

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b12d23e2ebb552bcc7a40011b72895f11c30bac92f745c2598904200b48f6e75/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 13:15:05 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wewshyxlwvjlzr5eaai3okev6eodbowjf52fyjmysbbabnepnz2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

xz b12d23e2ebb552bcc7a40011b72895f11c30bac92f745c2598904200b48f6e75

(this sample)

NanoCore

Executable exe 6ece00da69537d12d933cfc710ef0be2f76ee8d39c111ba1726bd47c8fb8acb1

  
Dropping
MD5 474f0117b9ffba8ab212f72abb791b45
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6ece00da69537d12d933cfc710ef0be2f76ee8d39c111ba1726bd47c8fb8acb1

Comments