MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10134e60c95416adb64713eef31fb396c0f2ecf97cb3162e4f01d40c851a8e8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10134e60c95416adb64713eef31fb396c0f2ecf97cb3162e4f01d40c851a8e8f
SHA3-384 hash: ccbff233f6158543bc91b197fb71696f4372185c88493a144f596e04ce7dd8dcf507648c60b14200181f765e01c91bb9
SHA1 hash: 76c5da535795e331b6f5f3b7ab02179156f1130a
MD5 hash: 33546f2f54f6b351131a69d175f84326
humanhash: asparagus-sierra-spaghetti-arizona
File name:DOC20200602FACEMASK.pdf.z
Download: download sample
Signature NanoCore
Create hunting rule
File size:768'778 bytes
First seen:2020-06-02 17:05:02 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 12288:nexNZj/l0HvLNCZJ0IU/7k7cVV6xRpuGYQNJW7TNbrdRcgcR62Y48JICc6zit:elz8LNu0IUTUcapuPJ7VrdCgs62YDIBV
TLSH 44F433E9359FC6EF793D2662398A82000903139063EE07F4E62D1EFB79A065FB919855
Reporter abuse_ch
Tags:NanoCore RAT z


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: vps.lopullew.com
Sending IP: 45.95.169.66
From: info@lopullew.com
Subject: Fwd: RE: RE: URGENT REQUEST FOR 3M N 95 1860 Masks
Attachment: DOC20200602FACEMASK.pdf.z (contains "DOC20200602FACEMASK.exe")

NanoCore RAT C2:
185.19.85.186:40510

Intelligence

File Origin
# of uploads :
1
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-06-02 17:36:31 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=caju4ygjkqlk3nshcpxpgh5ts3apf3hzpszrmlspahkazbi2r2hq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

z 10134e60c95416adb64713eef31fb396c0f2ecf97cb3162e4f01d40c851a8e8f

(this sample)

NanoCore

Executable exe ca05f7a026f3e7fe6cdb73437a37629a528a7a62564c4a1866bc00442a2f2750

  
Dropping
MD5 3fca62fe4fdde607ad0a4ebcfeffe3ce
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ca05f7a026f3e7fe6cdb73437a37629a528a7a62564c4a1866bc00442a2f2750

Comments