MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d01153145f5e59bcfd7116702e1e63739eb41c33088ec64b748c7df8936b4f10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d01153145f5e59bcfd7116702e1e63739eb41c33088ec64b748c7df8936b4f10
SHA3-384 hash: 604c6b84f99cac0e7a3713a79261568ee647285d1bfbbc9634f075cd56d93722efda6126bc8dd5c1e47fa58483b1e3e4
SHA1 hash: fb8fb6cdef06234d1a168166849971b02e1f95cc
MD5 hash: facb3f68bd01c9c4088391bd6d1047ee
humanhash: illinois-skylark-autumn-ten
File name:Scan-0581110_pdf.gz
Download: download sample
Signature NanoCore
Create hunting rule
File size:442'255 bytes
First seen:2020-05-25 09:23:22 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:7C8P8SLgfnFVdy/TqSnT6XAxWcKWDNEgpTRciBXjikxdXfX:bRwUZJ/LDNBpTieNxdXfX
TLSH 6494234C0B39C46069EADBA478EF635E29BD317F1003639033D7DE669A7B518D1BC982
Reporter abuse_ch
Tags:gz NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: serve0.chinarubii.pw
Sending IP: 173.82.119.236
From: Account payables <accounting@dynastysfo.com>
Subject: FW: Bank Transfer Confirmation
Attachment: Scan-0581110_pdf.gz (contains "Scan-0581110_pdf.exe")

NanoCore RAT C2:
23.82.140.49:4111

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Sanesecurity.Malware.25815.ZipHeur.BadExt.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 06:40:57 UTC
File Type:
Binary (Archive)
Extracted files:
296
AV detection:
30 of 48 (62.50%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip d01153145f5e59bcfd7116702e1e63739eb41c33088ec64b748c7df8936b4f10

(this sample)

NanoCore

Executable exe eddb02f1d6ecdcfb30630930e91c51d05d71e18b348c4e3ef2f6a84d2895ba6d

  
Dropping
MD5 6974295bc671f842efd93381968105b7
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 eddb02f1d6ecdcfb30630930e91c51d05d71e18b348c4e3ef2f6a84d2895ba6d

Comments