MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 31f1dd0850d8d59104cb91047eb6e2f93442816590ba050967c97a995f556186. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 31f1dd0850d8d59104cb91047eb6e2f93442816590ba050967c97a995f556186
SHA3-384 hash: 4005562e35b82a2e5f91bedaf17044bf548e0d984b29908b8ee8ebfe8a7841a52a760cabca94eb510faf8b8949c7c866
SHA1 hash: 928f28c2700d2e37d68611a94510950ba818537e
MD5 hash: 0a6352af87b8377726f5484a74859c2a
humanhash: tango-michigan-purple-nuts
File name:Scan002.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:740'742 bytes
First seen:2021-01-12 06:18:07 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:IZ/nJm2JiEEG8BPQaC3klRk7d8BTfpJL/uRAvhew1SWSEeZlIZx2iPLodX:wJ7JiEEGEY10IWJL/uBwRI28zp
TLSH 42F4231761FA5B259940BDCE199EB333F08FA31A4B245E2EEF826752C4820D7FED6105
Reporter abuse_ch
Tags:NanoCore rar RAT Yahoo


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: sonic304-52.consmr.mail.gq1.yahoo.com
Sending IP: 98.137.68.234
From: Mahdi Alzobai <alsdaqa_transport@yahoo.com>
Attachment: Scan002.rar (contains "Scan002.exe.exe")

NanoCore RAT C2:
innocentbooii.hopto.org:55420

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/31f1dd0850d8d59104cb91047eb6e2f93442816590ba050967c97a995f556186/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2021-01-12 06:19:05 UTC
AV detection:
12 of 46 (26.09%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ghy52ccq3dkzcbglsech5nxc7e2efalfsc5akclhzf5jsx2vmgda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/31f1dd0850d8d59104cb91047eb6e2f93442816590ba050967c97a995f556186

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 31f1dd0850d8d59104cb91047eb6e2f93442816590ba050967c97a995f556186

(this sample)

NanoCore

Executable exe dd647e98e0bd3b1627a0385970c38cd046883967f39dbf9fe416d5300e8e310a

  
Dropping
MD5 8e2315d05c47fefdddf0a686bf9e353e
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 dd647e98e0bd3b1627a0385970c38cd046883967f39dbf9fe416d5300e8e310a

Comments