MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 566565b7483e59915b5ae900594ecbdc159ca935c5e28a36d419c6e00b0dd697. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 566565b7483e59915b5ae900594ecbdc159ca935c5e28a36d419c6e00b0dd697
SHA3-384 hash: 8fa16e3a462973ed7898b5a65162935264529476ff41a5229ded3b10d09f818cda58227c017a5b05a670b5c63a6530e8
SHA1 hash: b23a730ed1cdaf28c59cb37d83c84cd7c43636cd
MD5 hash: ff5ef2db1e4c948e7cd14f9948a1649a
humanhash: hotel-uranus-missouri-paris
File name:List od requied order.r01
Download: download sample
Signature NanoCore
Create hunting rule
File size:406'171 bytes
First seen:2020-08-10 13:06:21 UTC
Last seen:Never
File type: r01
MIME type:application/x-rar
ssdeep 6144:6f2c/41DPT/Ag/zsgWzWbKgLZgmfjm5En7mPXCsX8gtIfczk9k+:6f2c/sYg/zaWbpg2j4Y70F6cQ9k+
TLSH 1D84233A4A5128D8DF6F8659EB000AA5C8FE0932512F85FEDEE8F03499D4784C797ED1
Reporter abuse_ch
Tags:Hostwinds NanoCore r01 RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: hwsrv-758891.hostwindsdns.com
Sending IP: 104.168.203.3
From: Afzal Abdulla <info@loburig.com>
Subject: Fw: List of required order 10-08-2020
Attachment: List od requied order.r01 (contains "list of requied order.exe")

NanoCore RAT C2:
mn255.freeddns.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/566565b7483e59915b5ae900594ecbdc159ca935c5e28a36d419c6e00b0dd697/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-08-10 13:08:06 UTC
AV detection:
6 of 48 (12.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kzswln2ihzmzcw225eafstwl3qkzzkjvyxriunwudhdoacyn22lq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
NanoCore
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/566565b7483e59915b5ae900594ecbdc159ca935c5e28a36d419c6e00b0dd697

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

r01 566565b7483e59915b5ae900594ecbdc159ca935c5e28a36d419c6e00b0dd697

(this sample)

NanoCore

Executable exe 396b6c41ac9807ef01fb5b3be94474857c85cbad51c0b21855431552fe1876a0

  
Dropping
MD5 2c9db9da55b4521687e0838353f9a0ff
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 396b6c41ac9807ef01fb5b3be94474857c85cbad51c0b21855431552fe1876a0

Comments