MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28cb45eb46292a33db4c473dae91d7e54be66016a7bebebc16c254b66cbcd2b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28cb45eb46292a33db4c473dae91d7e54be66016a7bebebc16c254b66cbcd2b1
SHA3-384 hash: 0ffbbb4be4a27ab7bdb682fab52d3fb49a36d18422061db64555596336e99492924c3cd660d3669b82b692cbb19ce160
SHA1 hash: ecb27cf4361acece64bcc877647a92f9c0b96fdc
MD5 hash: bde51fb914cee7e20aefa4004bf1a3b3
humanhash: eight-timing-saturn-maryland
File name:RE Revised Order 19300.r00
Download: download sample
Signature NanoCore
Create hunting rule
File size:578'854 bytes
First seen:2020-08-28 05:49:37 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:j/RGU/y5xp0ayNSL5/IRrJxgAlK3M6BwKcJf:j/RGUq5PllCRcAlX6Bwl
TLSH 65C4237BBDF6CF225A9E24B556B2D8D68053EDA19F00D8DC69603090BDD29473B0DB2C
Reporter abuse_ch
Tags:Hostwinds NanoCore r00 RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: hwsrv-762625.hostwindsdns.com
Sending IP: 104.168.242.71
From: sales@warehouse7.gr
Subject: Re:Fwd: Revised Order #19300
Attachment: RE Revised Order 19300.r00 (contains "VttVY345MqorZD6.exe")

NanoCore RAT C2:
hampowell.ddns.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28cb45eb46292a33db4c473dae91d7e54be66016a7bebebc16c254b66cbcd2b1/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-28 05:51:08 UTC
AV detection:
13 of 29 (44.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fdful22gfevdhw2mi4625eox4vf6myawu67l5pawyjklm3f42kyq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/28cb45eb46292a33db4c473dae91d7e54be66016a7bebebc16c254b66cbcd2b1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

r00 28cb45eb46292a33db4c473dae91d7e54be66016a7bebebc16c254b66cbcd2b1

(this sample)

NanoCore

Executable exe 036c0fbb1ffb23e9bfd4b4834a396d79ec319078865adf3ef75418450cf9fd18

  
Dropping
MD5 5a8d6faf7b662fe37606a171a2b6bc11
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 036c0fbb1ffb23e9bfd4b4834a396d79ec319078865adf3ef75418450cf9fd18

Comments