MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e87376ae889b5eb13cc1cbebb3cf3e08816b42d1bf2efd8b5fe9c40631ebc08. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e87376ae889b5eb13cc1cbebb3cf3e08816b42d1bf2efd8b5fe9c40631ebc08
SHA3-384 hash: 2bb04eebe42bed9e67c62a8363b3dcbe9771049e5e8fc1e1035ccdcf7a5117168dfb6c526507ec958ed788297bd7d749
SHA1 hash: 8af79e75a0f39b77b3a8a7fc9ab80bd2962f697b
MD5 hash: 6f3f8d08ff7c7a8a1e409b0c323322c7
humanhash: robin-utah-tango-hot
File name:Evidence.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:673'341 bytes
First seen:2020-10-10 06:40:59 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 12288:T25nT5vrnOxKyaC/oOdYUHYa4HzFDQp54jo5qkaVCuO+tJ7rPdsTrx5eRn9rn8AC:svrniaCAOdNH94BDQpZ8kaVCuO+vn1sr
TLSH 82E4236271A2A144D2068DE0FA9FB4701C81EAA50DC6F6F813563ED3B561C5F0E8F6E7
Reporter abuse_ch
Tags:NanoCore RAT zip


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: host.ighosting.biz
Sending IP: 67.222.12.26
From: shevchenko <smtpfox-29lmd@brazosrecovery.com>
Subject: I know what you did
Attachment: Evidence.zip (contains "Evidence.pdf.exe")

NanoCore RAT C2:
andrew566-21312.portmap.io:21312 (193.161.193.99)

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e87376ae889b5eb13cc1cbebb3cf3e08816b42d1bf2efd8b5fe9c40631ebc08/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-10-09 08:37:51 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l2dto2xirg26we6mds7lwpht4cebnnbndpzo7wfv72oeayy6xqea._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
DarkComet
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5e87376ae889b5eb13cc1cbebb3cf3e08816b42d1bf2efd8b5fe9c40631ebc08

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip 5e87376ae889b5eb13cc1cbebb3cf3e08816b42d1bf2efd8b5fe9c40631ebc08

(this sample)

NanoCore

Executable exe 59f8ca1089708a345369b0abba85484f80b9adff6ac51c152be5110ef6d840d2

  
Dropping
MD5 3d594dc02f12cf706902803ff58f7b0b
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 59f8ca1089708a345369b0abba85484f80b9adff6ac51c152be5110ef6d840d2

Comments