MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ac189f09a38a608044a970587bee19da05d7db9b3e30a2ae7a7d1ef57797fd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4ac189f09a38a608044a970587bee19da05d7db9b3e30a2ae7a7d1ef57797fd5
SHA3-384 hash: 8848827448865bd6066b6da0a52dd101f80007ca6b3eeeaf829cdd1f1ab220b5083044256188ebdfb84c1c7627ac941a
SHA1 hash: 0cd6df2dde0e4c9060f14d141a4f4260b7acc4f5
MD5 hash: 65838317f5215eb82aeb5a058704b729
humanhash: zebra-network-floor-wyoming
File name:DHL_file 187652345643476245.iso
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'056'768 bytes
First seen:2020-12-28 07:57:29 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:Om14yD4K25i2KmD2kpCOiZl5uOJFAHOM0GHL3+sSncYSqfoTAPTS9O85h:D1YKQKm2OiL5uOJOu3nVSbGmO85h
TLSH C125BF162294AB56D6B977781F60C53013F1AC098A21D6B97CEC3D8F3BFEA435972231
Reporter abuse_ch
Tags:DHL Hostwinds iso NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: hwsrv-816835.hostwindsdns.com
Sending IP: 104.168.174.166
From: DHL Express <sales@gommcp.com>
Subject: 紧急 - DHL Shipment Document
Attachment: DHL_file 187652345643476245.iso (contains "DHL_file 187652345643476245.exe")

NanoCore RAT C2:
185.157.160.233:54984

Intelligence

File Origin
# of uploads :
1
# of downloads :
490
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Nanocore.23.14130.27587.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4ac189f09a38a608044a970587bee19da05d7db9b3e30a2ae7a7d1ef57797fd5/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-12-28 03:20:11 UTC
AV detection:
11 of 28 (39.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jlayt4e2hctaqbcks4cyppxbtwqf27nzwprqukxhu7i66v3zp7kq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4ac189f09a38a608044a970587bee19da05d7db9b3e30a2ae7a7d1ef57797fd5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

iso 4ac189f09a38a608044a970587bee19da05d7db9b3e30a2ae7a7d1ef57797fd5

(this sample)

NanoCore

Executable exe 0b45301c562af6da8c63164d1f13b38a6147202d16503ae2cbe99948e842ff33

  
Dropping
MD5 91a8de5df364a51c14c34d1fc4521827
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 0b45301c562af6da8c63164d1f13b38a6147202d16503ae2cbe99948e842ff33

Comments