MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e2fe535a1da5843961468c50eb73c659f97d38b4eb5d692e64cb4eb3292f533. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 3

Intelligence 3 IOCs YARA File information Comments

SHA256 hash:	4e2fe535a1da5843961468c50eb73c659f97d38b4eb5d692e64cb4eb3292f533
SHA3-384 hash:	aaf50ee9f459da3a51b37523c3d4ce46bd83c36af62cf9eacf0a7f9ced523879ba315ec91decb2a5baccab9dcd6724c6
SHA1 hash:	36b3b3ec311b129b07317008fd783271a35b03fb
MD5 hash:	5eb573519e73ee9d9f0a7932339a7f96
humanhash:	speaker-south-violet-moon
File name:	P.O29062020.gz
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	313'765 bytes
First seen:	2020-06-29 07:24:00 UTC
Last seen:	Never
File type:	gz
MIME type:	application/x-rar
ssdeep	6144:1Dp1I+Ocm1RZ627/KPUOm0IUKshWWk2hDphZ7XMHDu6G5ZYyN6ATYC8zVjvYJ2bY:1kB31RZ62uP5TIUKshW0ZphZbIDu6G7n
TLSH	226423CC4AB7CCEC465E829B91281825A991BA08D11FDE3F48E247A8D135F3F97DD249
Reporter	abuse_ch
Tags:	gz NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: mailbox-adminupdates.com
Sending IP: 193.168.3.211
From: Accounts <export-sales@mailbox-adminupdates.com>
Subject: Re; Balance Payment Overdue
Attachment: P.O29062020.gz (contains "P.O29062020.exe")

NanoCore RAT C2:
ezego.duckdns.org:4197 (194.5.97.125)

Pointing to nVpn:

% Information related to '194.5.97.0 - 194.5.97.255'

% Abuse contact for '194.5.97.0 - 194.5.97.255' is 'abuse@inter-cloud.tech'

inetnum: 194.5.97.0 - 194.5.97.255
netname: Privacy_Online
remarks: ------------------------------------------------------------------------
remarks: This prefix is used by a non-logging VPN service provider.
remarks: We don't log any user activities.
remarks: We don't host anything else on our servers than VPN software (OpenVPN,
remarks: IKEv1 & 2, WireGuard ...).
remarks: Our customers can open up to 8 Ports (TCP & UDP).
remarks: We support the Tor Project: https://www.torproject.org
remarks: Before sending us potential complaints, please read:
remarks: https://www.torservers.net/abuse.html
remarks:
remarks: We are under constant pressure by Spamhaus.
remarks: Spamhaus issues tons of fake SBL listings in order to destroy our service.
remarks: They use fake identities, violate EU laws and hide outside the EU in
remarks: Andorra to avoid legal consequences.
remarks: Please don't trust this organization.
remarks: If you have any questions related to our service, please contact us
remarks: directly via e-mail: support@inter-cloud.tech
remarks:
remarks: Thank you.
remarks: ------------------------------------------------------------------------
admin-c: RA9926-RIPE
tech-c: RA9926-RIPE
org: ORG-NFAS6-RIPE
country: RU
status: SUB-ALLOCATED PA
mnt-by: inter-cloud-mnt
created: 2018-07-23T09:31:45Z
last-modified: 2020-03-10T21:27:32Z
source: RIPE