MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e06a0ebf139e79d93b9cf202c7da05b1fb5d167f224fcd7b2e4f039e6d2caef8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e06a0ebf139e79d93b9cf202c7da05b1fb5d167f224fcd7b2e4f039e6d2caef8
SHA3-384 hash: cb0297a8595bd780ab8f43b5cb28c28c7e384f03d7ce9276d40f01c866858938afa99b156b6d07ad1bbcb1f53e783f78
SHA1 hash: 1a6a4a09bb35b64e2d9f379b9f27f059d07535e6
MD5 hash: c499e257c3398e330aca74d211498df4
humanhash: black-zebra-berlin-venus
File name:quote-order1764894,pdf.r11
Download: download sample
Signature NanoCore
Create hunting rule
File size:270'675 bytes
First seen:2020-04-30 12:38:31 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:9ajqWDNrvTL5GTErvQ8SdMLjZKLgVgb55WcS9wq4s00OQ4:8jqYBTL5GwrvQxduZKLggCL4s0lF
TLSH E24423246E7805AB68CF5231E961EFCDC34643A7A72D83C1B41FE7A1A5CB5B928348D4
Reporter abuse_ch
Tags:NanoCore r11 RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: serve0.nugraha.pw
Sending IP: 157.230.47.198
From: Allen.Cole@globalxtend.com <ventas@nugraha.pw>
Subject: GIVE US QUOTE
Attachment: quote-order1764894,pdf.r11 (contains "quote-order1764894,pdf.exe")

NanoCore RAT C2:
172.94.44.202:1245

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 13:35:59 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4bva5pyttz45so446ibmpwqfwh5v2ft7ejh426zoj4bz43jmv34a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar e06a0ebf139e79d93b9cf202c7da05b1fb5d167f224fcd7b2e4f039e6d2caef8

(this sample)

NanoCore

Executable exe 9b68e02336db788b19b453627fc5e0c76d8c3fe9769a34aaf14bc2c6a8dfc024

  
Dropping
MD5 05803617fea180a45a8f5ae52ebc2748
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9b68e02336db788b19b453627fc5e0c76d8c3fe9769a34aaf14bc2c6a8dfc024

Comments