MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 389305da624b7a46f9005265328da25b6c469e1941f46c2c89360496428a5240. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 389305da624b7a46f9005265328da25b6c469e1941f46c2c89360496428a5240
SHA3-384 hash: 7f4e5b939ba84d11b9a9579b49b8bc4701c1566b93444962ac9ca8b70f9c3c1d43326e14ad186948c3235a30e1ba9590
SHA1 hash: 880958c21b65a5adb068aeb1230c2d9797ccacd2
MD5 hash: fa5a546ebca97adc4d2f2a0fb241787d
humanhash: idaho-mexico-hamper-winter
File name:POCM 202100322.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:670'159 bytes
First seen:2021-02-04 17:22:38 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:A4OhFz/GbYKqG+wmJ4JoPuygcpmq5AG/c6HVGoIk4Bahg6DfNLH9:A4bqxww4JLcDHVOk4B2x79
TLSH C2E43323D2F6C156C7A937B25A115B0A4529B82063FD2316E25FE8C3FEE5C24B59F01E
Reporter abuse_ch
Tags:NanoCore RAT zip


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: vps.helitactica.xyz
Sending IP: 203.159.80.22
From: Ullah Ashraf <office@helitactica.xyz>
Reply-To: Ullah Ashraf <sdmarine861000@gmail.com>
Subject: New order POCM 20191003
Attachment: POCM 202100322.zip (contains "WYrda6jndNhSF8Z.exe")

NanoCore RAT C2:
fgtrert.duckdns.org:4948 (37.46.150.65)

Intelligence

File Origin
# of uploads :
1
# of downloads :
276
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Razy.285399.9207.15039.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/389305da624b7a46f9005265328da25b6c469e1941f46c2c89360496428a5240/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-02-04 17:23:09 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hcjqlwtcjn5en6iakjstfdnclnwenhqzih2gylejgycjmqukkjaa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.59
Link:
https://yomi.yoroi.company/submissions/389305da624b7a46f9005265328da25b6c469e1941f46c2c89360496428a5240

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip 389305da624b7a46f9005265328da25b6c469e1941f46c2c89360496428a5240

(this sample)

NanoCore

Executable exe bea111c867cbf7c5af5a033288006b8358e1fb598d99718568cfa43239eb68e0

  
Dropping
MD5 47a63c083cb264562611434dc8565bb2
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 bea111c867cbf7c5af5a033288006b8358e1fb598d99718568cfa43239eb68e0

Comments