MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ded7387c39ab747dfcb6f77c6e524c1e78a2c971f3068513b3c844c7105d1df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1ded7387c39ab747dfcb6f77c6e524c1e78a2c971f3068513b3c844c7105d1df
SHA3-384 hash: 3ec8238ea5f01306e1046fab487b8cab00cfc8cf0a0e98e38defd748a8b4efbca04ff3e1496646741ca76aa208213f25
SHA1 hash: b64a7b5354a777da04cbaae3c131278fa0078ac9
MD5 hash: a15655f2640c79a7c521d3d9b0374e41
humanhash: pasta-skylark-saturn-quebec
File name:CV_JOB REQUEST_Pdf.iso
Download: download sample
Signature NanoCore
Create hunting rule
File size:555'008 bytes
First seen:2020-07-07 12:41:21 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:8MvByE1k4j2XSiFlXd0Y4SaXXV/8g/6rxdNHtiD5ZCV661OU+BHtCOn81WXPHsh/:JTU+xBn2PSnHpYG/mv9
TLSH BEC4AD3122A5AF86C9398BF5651425405FB139AF627DD26C7CC830CB16EAF044EA5FB3
Reporter abuse_ch
Tags:iso NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: gmail.com
Sending IP: 209.58.149.65
From: Deborah_Fankhauser <kakajanabdiye@gmail.com>
Subject: CV_JOB REQUEST
Attachment: CV_JOB REQUEST_Pdf.iso (contains "CV_JOB REQUEST_Pdf.exe")

NanoCore RAT C2:
yaunywxb.ddns.net:2451 (105.112.100.238)

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1ded7387c39ab747dfcb6f77c6e524c1e78a2c971f3068513b3c844c7105d1df/
Threat name:
ByteCode-MSIL.Trojan.FormBook
Create hunting rule
Status:
Malicious
First seen:
2020-07-07 12:43:05 UTC
AV detection:
15 of 29 (51.72%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dxwxhb6dtk3upx6ln534nzjeyhtyulexd4ygquj3hscey4if2hpq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

iso 1ded7387c39ab747dfcb6f77c6e524c1e78a2c971f3068513b3c844c7105d1df

(this sample)

NanoCore

Executable exe 500993334540fe89b080d37fcfe6c1a46745e668232cca7f672925674b38761c

  
Dropping
MD5 37aa5a40f887d4af4058ed721e3b400d
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 500993334540fe89b080d37fcfe6c1a46745e668232cca7f672925674b38761c

Comments