MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3264f1590eb5c3697606ce356dc1f8005958337fad93be8a6bf418a39484f82e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	3264f1590eb5c3697606ce356dc1f8005958337fad93be8a6bf418a39484f82e
SHA3-384 hash:	6a81307da01630120e3435861147c65c4ddc5f1733ed51a1346a8c6e0c7f257f1f9f05b59c0daa657ef6ec3350f8fd22
SHA1 hash:	54b6bd19bf9e138def706da550219df36d44600a
MD5 hash:	5a2a7005ce9a38132e4005b2017a1529
humanhash:	violet-three-five-twelve
File name:	000 020 005 020.r11
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	604'962 bytes
First seen:	2020-07-20 07:35:42 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:mFzR2Ors+577eg9rj7tgR8S0Xr91ZgNhqBVU3AHE780PS9pa:mRcc577egd3XZ1ZoqjUqW8/a
TLSH	3BD4237A50A9FD823FA7E11124664E171FBE7DF8066A2C0F44B255329C4B68B4297C2E
Reporter	abuse_ch
Tags:	NanoCore nVpn r11 RAT

abuse_ch

Malspam distributing NanoCore:

HELO: vps.uncethsa.com
Sending IP: 45.95.170.154
From: Дарина Костова <info@uncethsa.com>
Subject: Re: НОВА ПОРЪЧКА
Attachment: 000 020 005 020.r11 (contains "000 020 005 020.exe")

NanoCore RAT C2:
liquidmetaring.myddns.rocks:6331 (91.193.75.27)

Pointing to nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@privacyfirst.sh'

inetnum: 91.193.75.0 - 91.193.75.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
abuse-c: ACRO34258-RIPE
mnt-by: PRIVACYFIRST-MNT
mnt-by: RIPE-NCC-END-MNT
status: ASSIGNED PI
org: ORG-KHd1-RIPE
sponsoring-org: ORG-MW1-RIPE
created: 2012-06-04T11:05:55Z
last-modified: 2020-07-15T15:25:07Z
source: RIPE