MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a4c8d48be6eafb2c567f67d1ea5a5d934a37b6181a037bcd08902434aa7586d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a4c8d48be6eafb2c567f67d1ea5a5d934a37b6181a037bcd08902434aa7586d
SHA3-384 hash: 930bce032b46250a7c4957aacdc0c9945c2ce309c916c658d2743dae98592039334b9ee067423cf06fda88d322dc963f
SHA1 hash: a5d66b541528dac211515d38584ed13268104b27
MD5 hash: 8e21bb3ac601d43faa278a037234b7e4
humanhash: jupiter-video-coffee-saturn
File name:Cheque against PI no 234443.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:480'851 bytes
First seen:2021-02-09 12:15:08 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:crfqpxIOX/6COVC3K7SGW3LhBWt1uFka2rF9XnFlQeB1/AJKV9mspvrgKW6GYsLC:cQviCXMOb84Fkr7X4eBOOnqY8ep
TLSH EAA423985A4DBF66CE7804BDF113A6A02D18104073B98495019ADFD1BEE1A3F11BA3FF
Reporter abuse_ch
Tags:GoDaddy NanoCore nVpn rar RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: sg2nlshrout02.shr.prod.sin2.secureserver.net
Sending IP: 182.50.132.194
From: Rakesh<rakesh@sterlingduro.com>
Subject: Reply to PI #234443 and awaiting further briefing
Attachment: Cheque against PI no 234443.rar (contains "Cheque against PI no 234443.exe")

NanoCore RAT C2:
gahenyt.myddns.me:6702

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2a4c8d48be6eafb2c567f67d1ea5a5d934a37b6181a037bcd08902434aa7586d/
Threat name:
ByteCode-MSIL.Trojan.CrypterX
Create hunting rule
Status:
Malicious
First seen:
2021-02-09 12:16:07 UTC
AV detection:
6 of 46 (13.04%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fjgi2sf6n2x3frlh6z6r5jnf3e2kg63bqgqdppgqrebegsvhlbwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2a4c8d48be6eafb2c567f67d1ea5a5d934a37b6181a037bcd08902434aa7586d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 2a4c8d48be6eafb2c567f67d1ea5a5d934a37b6181a037bcd08902434aa7586d

(this sample)

NanoCore

Executable exe 1487f4e41d24b3440b5d87ca47a899f799f831824bd4d6dd8bb506637157a8ec

  
Dropping
MD5 b82a2c603292c4643e5b63e1337a3ae8
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 1487f4e41d24b3440b5d87ca47a899f799f831824bd4d6dd8bb506637157a8ec

Comments