MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fff41d3fd8f81b5be9332b2c2268eeee20b99eeea1c69f093c69c6ba2939acde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fff41d3fd8f81b5be9332b2c2268eeee20b99eeea1c69f093c69c6ba2939acde
SHA3-384 hash: e1064a94c054a297ce94b24af7a2c5fbe4e3b60f0a18e339b6da7fbf927838521bfddfbce6963fdc6756b2003aefc9a5
SHA1 hash: 35923806598f06b9b61df55411536d60780de35a
MD5 hash: 9e3e35d26976c238aa1d96d28f895ad5
humanhash: floor-nebraska-blue-football
File name:Purchase Order No-PO00000261.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:15'772 bytes
First seen:2020-05-22 15:00:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:ya/ZePP3THtvuFaYjv4/ohzA3oUIqoIF8HMx8/9It:yac3THRs0kNUIqoNMx8/+
TLSH 9362C0E3D82EFB60F75E5ABC08C91C44044D26F1F2A9EC8DAA3641653DD691D07DE0E5
Reporter abuse_ch
Tags:NanoCore nVpn rar RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: s214413.cloud.flynet.pro
Sending IP: 85.117.233.201
From: Panagiotis Vlaxos <pvlaxos@greencola.gr>
Subject: Purchase Order #No .: PO00000261
Attachment: Purchase Order No-PO00000261.rar (contains "Purchase Order #No-PO00000261.exe")

NanoCore RAT C2:
dikaa.ddns.net:1970 (105.112.99.164)

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Rdn
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 15:36:02 UTC
File Type:
Binary (Archive)
Extracted files:
2
AV detection:
17 of 48 (35.42%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar fff41d3fd8f81b5be9332b2c2268eeee20b99eeea1c69f093c69c6ba2939acde

(this sample)

NanoCore

Executable exe dd5ffc8cf8c384d67b8a0f288b0480abe2edfb1ca5d74f45c255d6e8bf876c02

  
Dropping
MD5 5be805bf04efa665ccc99740085c8507
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dd5ffc8cf8c384d67b8a0f288b0480abe2edfb1ca5d74f45c255d6e8bf876c02

Comments