MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56ceda4cccf673800e618186c9ea7f9c7a2ca9e64e762ab4b38cbc120e24fd8c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	56ceda4cccf673800e618186c9ea7f9c7a2ca9e64e762ab4b38cbc120e24fd8c
SHA3-384 hash:	1eec829f95d34acc9dad2b07b21041d5626914203914fa5b4e0511c2b7201f5b59848cd33a79ed4d5d920c9622da2eaf
SHA1 hash:	4b30250ce9962615c3c63bcdef2c45ac11e57a10
MD5 hash:	6f4b817f21e7664eef0bc3590edba0f7
humanhash:	sink-oscar-salami-skylark
File name:	DHL Notice on Customs Payment 6900449581.zip
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	615'011 bytes
First seen:	2020-07-20 07:42:50 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:EdUgpJrSS07SL25rjw+Gk4e1yoDFu64HsLofs3ArbpdsBi:wUgL2T7SL25jHcoD/4MfUyi
TLSH	DAD42396C0C3A6A5199B217F17A3DB494FCB5102F535EAE64BFF8BC2300D4354EE9A84
Reporter	abuse_ch
Tags:	DHL NanoCore nVpn RAT zip

abuse_ch

Malspam distributing NanoCore:

HELO: hwsrv-748333.hostwindsdns.com
Sending IP: 192.236.198.19
From: jaejoon.cho<jaejoon.cho@dhl.com>
Subject: [DHL] Notice on Customs Payment (6900449581)
Attachment: DHL Notice on Customs Payment 6900449581.zip (contains "[DHL] Notice on Customs Payment (6900449581).exe")

NanoCore RAT C2:
annapro55.ddns.net:2121 (185.140.53.167)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-BE-NL4
country: EU
descr: Zaventem, Belgium
descr: Amsterdam, Netherlands
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-07-16T21:16:41Z
source: RIPE