MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d247b880c71a85abaa2fbe0214509714c9f816100f769b101684a510d405fef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d247b880c71a85abaa2fbe0214509714c9f816100f769b101684a510d405fef
SHA3-384 hash: 0d486a5a78299c63774e71f83b5c1997389a9ccc614fb1819d39c7add76bc486006fa2225f3f35edc61f5152b0dc8e9e
SHA1 hash: fdd60c01e7111757cbc8128b6c2f3d9839386def
MD5 hash: c2d412a6f3b2859b78465be58522acb0
humanhash: lake-carbon-burger-mobile
File name:DES_ Holdings Ltd - products listing.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:613'649 bytes
First seen:2021-01-06 16:32:55 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Hl1bImM5n2/KZ5M4e2Kk37l0/EuYU4dmGNKn0T+6t+fvIk:nImMl225E2z7l0/EeIZLt+fgk
TLSH D4D433B76C28744440069E607704BE9F46E2343D7DCA30AF917A2EA7F324595AE81FAC
Reporter abuse_ch
Tags:NanoCore rar RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: srv.kibriswebhizmetleri.com
Sending IP: 213.159.5.123
From: DESIGNATED HOLDINGS LTD <info@inndormcyprus.com>
Subject: Request for Quotation
Attachment: DES_ Holdings Ltd - products listing.rar (contains "DES_ Holdings Ltd - products listing.exe")

NanoCore RAT C2:
212.83.46.26:4021

Intelligence

File Origin
# of uploads :
1
# of downloads :
247
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.24799.23286.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d247b880c71a85abaa2fbe0214509714c9f816100f769b101684a510d405fef/
Threat name:
ByteCode-MSIL.Trojan.Taskun
Create hunting rule
Status:
Malicious
First seen:
2021-01-06 16:33:04 UTC
AV detection:
9 of 44 (20.45%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fushxcamogufvovc7pqccrijofgj7albad3wtmibnbffcdkal7xq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2d247b880c71a85abaa2fbe0214509714c9f816100f769b101684a510d405fef

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 2d247b880c71a85abaa2fbe0214509714c9f816100f769b101684a510d405fef

(this sample)

NanoCore

Executable exe 7bfe37fe1a33afd35833f4085fed761a854dd617df861a10fb7ad4e25d0f78a9

  
Dropping
MD5 a07c438611c59fad6083faf789d40917
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7bfe37fe1a33afd35833f4085fed761a854dd617df861a10fb7ad4e25d0f78a9

Comments