MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 093ae2d710e55d389ae27488fbf75ec1e02d577926b7d1a12518f5de728ab875. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 093ae2d710e55d389ae27488fbf75ec1e02d577926b7d1a12518f5de728ab875
SHA3-384 hash: cce550a0ec8ee091f219f0ccd91eb9356af4646c3ebc2d1e0d56872a7481a71b863d2afd727f8396e066c450d6116af7
SHA1 hash: 5f1e9f05c228bdce10ca323ac8b11e4730f656a6
MD5 hash: 2fae55bb48a2214f73c3fb026d4ae21b
humanhash: music-blossom-alanine-cat
File name:Refund Report.img
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'245'184 bytes
First seen:2020-06-06 17:48:21 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:sPz3vKANdPMbzogR+qEiCZrJUMhHGlIf6BHHB/p0T6S8jAwnWC+I5tiDLYjMSOTW:s9tqEL9JfmloMHhh0T18PnDtOW
TLSH 53458D6513B44A1EDBBE8B3AEA7610055DF3B8036932D74E8CEC34EA1B23B515901B77
Reporter abuse_ch
Tags:img NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: zimbra.fcjcorp.com
Sending IP: 54.158.42.8
From: Mathew Ki <pedro.henrique@medbeta.com.br>
Reply-To: noreply@accounts.com
Subject: Refund
Attachment: Refund Report.img (contains "Refund report.exe")

NanoCore RAT C2:
mikeeee.duckdns.org:9284 (149.28.194.188)

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.WEZ.6619.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-06-06 17:50:08 UTC
AV detection:
16 of 31 (51.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=be5ofvyq4votrgxcosepx526yhqc2v3ze235dijfdd2544ukxb2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

img 093ae2d710e55d389ae27488fbf75ec1e02d577926b7d1a12518f5de728ab875

(this sample)

NanoCore

Executable exe 243db86744fa513ab98ee06a6557d852a861b49e9a47784ddb881f6ff78d071e

  
Dropping
MD5 1cfe5e7459f1c3216d0806689de00565
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 243db86744fa513ab98ee06a6557d852a861b49e9a47784ddb881f6ff78d071e

Comments