MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5639019875993d78a20c90b60c31ca2c3356f6868980f126022b719eb5852b53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5639019875993d78a20c90b60c31ca2c3356f6868980f126022b719eb5852b53
SHA3-384 hash: cb1f09f616998341a8a5b4b3a4be59432f2cd8bfbfd6f6ee06bd1bfe93a1d55b9c363a03b690a17cd3c119f638bb0581
SHA1 hash: 5f5548f7ec33d864759c96f15859e5faae1906b7
MD5 hash: ad7907e5a3250af037d97befad7d964b
humanhash: hotel-georgia-snake-missouri
File name:DHL_document1102202068090891.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:15'986 bytes
First seen:2021-02-25 10:02:15 UTC
Last seen:2021-02-26 02:16:36 UTC
File type: zip
MIME type:application/zip
ssdeep 384:1+VIVloIE9vCov4c1BL+eneJMj/0hYOrhSfE5brWoK:1xlVEUA4c1BL+SeM/0YOgfE5bqoK
TLSH F872C0A80BB4C798F2DC25B217EC3889E8629315383614593956092DFEED13BDD5CF25
Reporter abuse_ch
Tags:CHN DHL geo NanoCore RAT zip


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: [193.239.147.27]
Sending IP: 193.239.147.27
From: China DHL Express <dhlcnsendreq6@dhl.com>
Subject: DHL送货/到达/地址确认
Attachment: DHL_document1102202068090891.zip (contains "DHL_document1102202068090891.exe")

NanoCore RAT C2:
noancore.linkpc.net

Intelligence

File Origin
# of uploads :
3
# of downloads :
218
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.4120.18998.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5639019875993d78a20c90b60c31ca2c3356f6868980f126022b719eb5852b53/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-02-25 09:34:46 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ky4qdgdvte6xriqmsc3aymokfqzvn5ugrgapcjqcfnyz5nmffnjq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip 5639019875993d78a20c90b60c31ca2c3356f6868980f126022b719eb5852b53

(this sample)

NanoCore

Executable exe 5b60eef7b62c70f68311f80199578144694445d28286c7c87e7f79ace2875580

  
Dropping
MD5 5e86ec60bc329db96be8d476537a554c
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 5b60eef7b62c70f68311f80199578144694445d28286c7c87e7f79ace2875580

Comments