MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ccb7546eb24888e9eca81fb9bcf26e4d6d7b455f3b029f2a2e9d6bbd400f654. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ccb7546eb24888e9eca81fb9bcf26e4d6d7b455f3b029f2a2e9d6bbd400f654
SHA3-384 hash: 6612aa41608cd7cb11cba433567d5b78363b10788f5f22c12b0f2fab8ce37c2df1aba1d90b6bead88917603e6b1c1160
SHA1 hash: ddd5ef5c4d175e1303d59046dd7f4fe849bb2361
MD5 hash: 422389bec8bf4921ebe2c709d12812cc
humanhash: august-red-leopard-friend
File name:DINTEC PO.z
Download: download sample
Signature NanoCore
Create hunting rule
File size:415'127 bytes
First seen:2021-01-13 15:59:13 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:v0UYCknNJI8U4rQYVVcFNL+DqljYcfgbCQk0nfe6l7iMfgowX6H7licAscZaS/c:vICCN6UqSOqczQkeen4gowX6HdAxdc
TLSH BC9423180703A7A6D578727544DF3EE71389428E36259CEEC287AFF0E9C69640F4D6E8
Reporter abuse_ch
Tags:NanoCore RAT z


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: joy.joyasha.com
Sending IP: 185.38.45.130
From: Shirley Lee <service@dintec.co.kr>
Subject: Re: DINTEC Order List
Attachment: DINTEC PO.z (contains "DINTEC PO.exe")

NanoCore RAT C2:
mnvh54254.ddns.net:6653 (95.181.155.123)

Intelligence

File Origin
# of uploads :
1
# of downloads :
153
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ccb7546eb24888e9eca81fb9bcf26e4d6d7b455f3b029f2a2e9d6bbd400f654/
Threat name:
ByteCode-MSIL.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-13 16:00:07 UTC
AV detection:
5 of 44 (11.36%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=htfxkrxlesei5hwkqh5zxtzg4tlnpncv6oyct4vc5hllxvaa6zka._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3ccb7546eb24888e9eca81fb9bcf26e4d6d7b455f3b029f2a2e9d6bbd400f654

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

z 3ccb7546eb24888e9eca81fb9bcf26e4d6d7b455f3b029f2a2e9d6bbd400f654

(this sample)

NanoCore

Executable exe 29800b7d8e8c3c60918a37c992a2890b4ccf9e4e0c949accd48821302d0f2891

  
Dropping
MD5 f1d00b68162820d29eb884a91b9e6a09
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 29800b7d8e8c3c60918a37c992a2890b4ccf9e4e0c949accd48821302d0f2891

Comments