MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48842640fca432c19b40bb3eff037f2bef2fdda4fdb674c2a3dbf9daaea61264. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	48842640fca432c19b40bb3eff037f2bef2fdda4fdb674c2a3dbf9daaea61264
SHA3-384 hash:	bd881dbbf681e389d3e3301743c08bd1c21d7e85f5eae7ba3f99cfd5cee8f8dd61a561f985214148eaa3fcf06fc91bfb
SHA1 hash:	785f45b7fd4feac5257be51d20e7160d6a34ff53
MD5 hash:	ebb47c2e08abd3f56a3394e715d27a2c
humanhash:	alabama-winner-fillet-charlie
File name:	PROOF OF PAYMENT.rar
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	312'564 bytes
First seen:	2020-06-29 11:43:55 UTC
Last seen:	2020-06-29 16:53:33 UTC
File type:	rar
MIME type:	application/x-rar
ssdeep	6144:h4btFy9iNzhY4xT8v+D+JwRmddh5sRow56Pxkd+PycIVvQBTUFYhlGKu4:hyi9MHxs+VGhsRors+PxIyBwFYhAKu4
TLSH	7364232029B2D7F1D105578E5A873A16F3C71EF3E12EBDC6CD88D7AC2D2636499E4244
Reporter	abuse_ch
Tags:	NanoCore nVpn rar RAT

abuse_ch

Malspam distributing NanoCore:

HELO: stpauls.stpaulsl.local
Sending IP: 97.82.28.20
From: Alcidemar Silva<asetline.za@gmail.com>
Reply-To: <asetline.za@gmail.com>
Subject: PROOF OF PAYMENT
Attachment: PROOF OF PAYMENT.rar (contains "PROOF OF PAYMENT.exe")

NanoCore RAT C2:
edubros.duckdns.org:2133 (194.5.99.13)

Pointing to nVpn:

% Information related to '194.5.99.0 - 194.5.99.255'

% Abuse contact for '194.5.99.0 - 194.5.99.255' is 'abuse@inter-cloud.tech'

inetnum: 194.5.99.0 - 194.5.99.255
netname: Privacy_Online
remarks: ------------------------------------------------------------------------
remarks: This prefix is used by a non-logging VPN service provider.
remarks: We don't log any user activities.
remarks: We don't host anything else on our servers than VPN software (OpenVPN,
remarks: IKEv1 & 2, WireGuard ...).
remarks: Our customers can open up to 8 Ports (TCP & UDP).
remarks: We support the Tor Project: https://www.torproject.org
remarks: Before sending us potential complaints, please read:
remarks: https://www.torservers.net/abuse.html
remarks:
remarks: We are under constant pressure by Spamhaus.
remarks: Spamhaus issues tons of fake SBL listings in order to destroy our service.
remarks: They use fake identities, violate EU laws and hide outside the EU in
remarks: Andorra to avoid legal consequences.
remarks: Please don't trust this organization.
remarks: If you have any questions related to our service, please contact us
remarks: directly via e-mail: support@inter-cloud.tech
remarks:
remarks: Thank you.
remarks: ------------------------------------------------------------------------
admin-c: RA9926-RIPE
tech-c: RA9926-RIPE
org: ORG-NFAS6-RIPE
country: GB
status: ASSIGNED PA
mnt-by: inter-cloud-mnt
created: 2019-07-20T20:42:53Z
last-modified: 2020-03-10T21:28:31Z
source: RIPE