MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41f7057c3604bedf2ceaf10293b6ed179c7ad5a9ea4b3cdc605f7fcb0b843b08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 41f7057c3604bedf2ceaf10293b6ed179c7ad5a9ea4b3cdc605f7fcb0b843b08
SHA3-384 hash: 05e2ec1225ea3b30a739142571eea47e9acb4d8fa7c3d7b5a1d45443ff32e2ab20d5a31c05e5540b26a14b3629b05f6c
SHA1 hash: f8496c895208f4f5b56fedaef3083e56f5d4d3ed
MD5 hash: 046653ecb3baf7fe15c36659ca150fe4
humanhash: nineteen-vegan-tennessee-earth
File name:PO968_8359808,pdf.iso
Download: download sample
Signature NanoCore
Create hunting rule
File size:657'408 bytes
First seen:2020-11-05 09:58:57 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:03YqKO8iCJw4uU/2UapK73hTC2bwToxgsLK9guuVeuN175bqpwi:1qIiqdH2UNJbwToY9JMX7Epwi
TLSH 19E4BE3122589F61F13EA7B89270581147F3BC52E731E91E7EAD70A92773E818672B13
Reporter abuse_ch
Tags:iso NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: h4.d2.pl
Sending IP: 5.9.75.114
From: Alejandra Galindo - Plexus <ventas1@bateriasrose.com>
Subject: Plexus Purchase Order New 968-8359808-OP
Attachment: PO968_8359808,pdf.iso (contains "PO968_8359808,pdf.exe")

NanoCore RAT C2:
billionaire.ddns.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Variant.Bulz.182762.10823.23778.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/41f7057c3604bedf2ceaf10293b6ed179c7ad5a9ea4b3cdc605f7fcb0b843b08/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-11-04 06:05:36 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ih3qk7bwas7n6lhk6ebjhnxnc6ohvvnj5jftzxdal574wc4ehmea._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

iso 41f7057c3604bedf2ceaf10293b6ed179c7ad5a9ea4b3cdc605f7fcb0b843b08

(this sample)

NanoCore

Executable exe ec230920e758500130af04a1e4231e62ffcbdfab7e548c865e84fb037ad42eb0

  
Dropping
MD5 61dc161f73d07f6bd283f037bc66041f
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ec230920e758500130af04a1e4231e62ffcbdfab7e548c865e84fb037ad42eb0

Comments