MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bf931b2e5868325a105e45a2e985512509a9e52ddd76f0d2c853e03529451d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	0bf931b2e5868325a105e45a2e985512509a9e52ddd76f0d2c853e03529451d2
SHA3-384 hash:	c5b64b6e59797049b4f1e59a65d12a9762b361282c2971ca95a19b1e1b934fe3b2851a26d17f3c2659e947dd40413173
SHA1 hash:	c99001bfe46db04058d633a5d53a320c500d5a8f
MD5 hash:	62d2c35721c42f82ca4b12d49a73f2a8
humanhash:	purple-venus-jupiter-speaker
File name:	DHL Notice on Customs Payment 6900449581.zip
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	320'237 bytes
First seen:	2020-07-22 07:07:14 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	6144:6jTpXV1OroC7pajCjVWcg62d58QQfNp1Un6R0e:QJOroGMncg6HPfNU6N
TLSH	766423F5FE87C8D9FF035E61111C821EDC369B8C1DA2394D065399AA99C9025CC3E7AE
Reporter	abuse_ch
Tags:	DHL NanoCore nVpn RAT zip

abuse_ch

Malspam distributing NanoCore:

HELO: hwsrv-748333.hostwindsdns.com
Sending IP: 192.236.198.19
From: jaejoon.cho<jaejoon.cho@dhl.com>
Subject: [DHL] Notice on Customs Payment (6900449581)
Attachment: DHL Notice on Customs Payment 6900449581.zip (contains "[DHL] Notice on Customs Payment (6900449581).exe")

NanoCore RAT C2:
annapro55.ddns.net:2121 (185.140.53.167)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-BE-NL4
country: EU
descr: Zaventem, Belgium
descr: Amsterdam, Netherlands
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-07-16T21:16:41Z
source: RIPE