MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 345cb39d37f4d2ddd98765b82e5901be5cc2b8eeda58f1b0282d5bf3262a464e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 345cb39d37f4d2ddd98765b82e5901be5cc2b8eeda58f1b0282d5bf3262a464e
SHA3-384 hash: a8f9eba14016762074a53b7e681458f3034598c626980e4595fa63a34a4d5ef2614fbc5ffafc8ffd477ee14c86996129
SHA1 hash: 40183d6d78f71701d7963a23e0d33b353a7ec4f8
MD5 hash: 5416a2e8584b54c62c17ac8a93044613
humanhash: mike-football-asparagus-oven
File name:CN-Invoice-XXXXX9808-19011143287989.iso
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'499'136 bytes
First seen:2021-02-02 07:45:39 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:ylFgi/vn/Bv7jnnRsaQZGCIV/KaITS1t0uNSICWtrP725EDCB48AC4VxDu:YJ/v/Bv7jnnRYGlL2RQSIz4B48v6x
TLSH 5265CA50A3F88A45C9B9F33716AB6F2E4387FCDB27208541671A8772109F1D17B5EB88
Reporter abuse_ch
Tags:FedEx iso NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: 64.188.20.113.static.quadranet.com
Sending IP: 64.188.20.113
From: FedEx Express - Do Not Reply <Carrie.Park@expeditors.com>
Reply-To: nopeply-fedeoxngr@iname.com
Subject: [CN]: FedEx Invoice 账单 (CustomerAccount -XXXXX9808-19011143287989)
Attachment: CN-Invoice-XXXXX9808-19011143287989.iso (contains "CN-Invoice-XXXXX9808-19011143287989 (2).exe")

NanoCore RAT C2:
annapro.linkpc.net:2212

Intelligence

File Origin
# of uploads :
1
# of downloads :
169
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/345cb39d37f4d2ddd98765b82e5901be5cc2b8eeda58f1b0282d5bf3262a464e/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-02 07:46:07 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=grolhhjx6tjn3wmhmw4c4wibxzomfoho3jmpdmbifvn7gjrkizha._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/345cb39d37f4d2ddd98765b82e5901be5cc2b8eeda58f1b0282d5bf3262a464e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

iso 345cb39d37f4d2ddd98765b82e5901be5cc2b8eeda58f1b0282d5bf3262a464e

(this sample)

NanoCore

Executable exe f17b941e86a7ba90d1452291d8357a8d02519d9ad1062d4c4a7fbf311a2499e4

  
Dropping
MD5 98d19a78cd19a6bddaf3721a167f4478
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f17b941e86a7ba90d1452291d8357a8d02519d9ad1062d4c4a7fbf311a2499e4

Comments