MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ddc0c04fd07bfd220c303793c39e3a5013ed58c3fdc3471df12d026482a1101. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ddc0c04fd07bfd220c303793c39e3a5013ed58c3fdc3471df12d026482a1101
SHA3-384 hash: 0f1e951f9b7b8c62c18411711812cedff88b9548b3d356056b4f0fcbcad69b346a57b8f32e95554ffc741d3252bb1139
SHA1 hash: 9b886d25ff8bc1790b303855b1e217a81aa97f11
MD5 hash: e925714c193be556025b1b04ce5edb9d
humanhash: jupiter-ten-saturn-floor
File name:SF express,pdf.iso
Download: download sample
Signature NanoCore
Create hunting rule
File size:878'592 bytes
First seen:2020-05-21 09:10:59 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:P7s/7xAae0vC3pZK9iAWILQq05xzO5NlhBbGvdlZFk7AxS8KhJhcX0Xc0hE5I3+n:P7cmZ+i7XqCxuvX+uAxS8Bd0O4vuzU8
TLSH A1151829635182BECB772BB5E421C81411975F305C389B6E3CBA31299F32F5D7E0693A
Reporter abuse_ch
Tags:iso NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: server.kanal77.com.mk
Sending IP: 195.201.106.91
From: SF Express <informations@sf-express.com>
Subject: Your parcel from China has arrived at our office (Parcel from Mr. Zhang Wei).
Attachment: SF express,pdf.iso (contains "SF express,pdf.exe")

NanoCore RAT C2:
megida123.ddns.net:9900 (91.193.75.15)

Pointing to nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@kgb-vpn.org'

inetnum: 91.193.75.0 - 91.193.75.255
netname: NON-LOGGING-VPN-SERVICE
descr: Please note that we don't store any user data.
descr: Our main effort is not to make money, but to preserve values like the
descr: freedom of expression, the freedom of press, the right to data protection
descr: and informational self-determination.
descr: We ask all employees of Spamhaus and all self-proclaimed deputy sheriffs
descr: to stop your attacks against us.
country: EU
admin-c: KA7109-RIPE
tech-c: KA7109-RIPE
org: ORG-KHd1-RIPE
status: ASSIGNED PI
mnt-by: RIPE-NCC-END-MNT
mnt-by: KGB-MNT
mnt-routes: KGB-MNT
sponsoring-org: ORG-MW1-RIPE
created: 2012-06-04T11:05:55Z
last-modified: 2019-12-05T05:39:00Z
source: RIPE


Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PWS.Siggen2.49161.8483.4375.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 04:34:52 UTC
AV detection:
17 of 31 (54.84%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fxoaybh5a675eigdan4tyopduuat5vmmh7odi4o7clicmsbkceaq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

iso 2ddc0c04fd07bfd220c303793c39e3a5013ed58c3fdc3471df12d026482a1101

(this sample)

NanoCore

Executable exe 8c9dfb93d93361ea136934230b8845e4a14c13caf2f6c2d0ad36c6decc60baf2

  
Dropping
MD5 9b9627b4bfae38be403209e593c0cfe1
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8c9dfb93d93361ea136934230b8845e4a14c13caf2f6c2d0ad36c6decc60baf2

Comments