MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e8b0096ea0d6e60dc9fdae1c26f038737588d0144a9dba172321faa5a24f8e3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e8b0096ea0d6e60dc9fdae1c26f038737588d0144a9dba172321faa5a24f8e3
SHA3-384 hash: a83d82df5a17af32d20549389c069ba2275c4763f3acf69b3a88376e6203a31b6d08b3512fdabd3fb8140a4dd870d5d6
SHA1 hash: 83673b437829ce6690bb1dc3e42b1df597cc2c4d
MD5 hash: cf01364121b25d342e3eb1d59908eb4d
humanhash: oxygen-fruit-lactose-mockingbird
File name:LIST OF DELISTED AGENCIES 22ND FEB 2021.uue
Download: download sample
Signature NanoCore
Create hunting rule
File size:612'056 bytes
First seen:2021-02-22 06:37:44 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 12288:wAdQMvKricoHjAVT5ftZHNaRrdMZ+yjjHjL1S6Jiu3GM6jR:wFMvKripkZ5ftZH0f8jFhGjR
TLSH 79D4238E028E07DA3C7C6C20608CEA5939DE1E77BD955F37E1660C18D4222DE7BC1796
Reporter abuse_ch
Tags:NanoCore RAT uue


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: sd.latticesystems.com
Sending IP: 204.152.206.90
From: ksa.Consulate manila <consulate_ksa_emb@gmail.com>
Subject: Memorandum
Attachment: LIST OF DELISTED AGENCIES 22ND FEB 2021.uue (contains "LIST OF DELISTED AGENCIES 22ND FEB 2021.PDF.exe")

NanoCore RAT C2:
shahzad73.casacam.net:9036

Intelligence

File Origin
# of uploads :
1
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e8b0096ea0d6e60dc9fdae1c26f038737588d0144a9dba172321faa5a24f8e3/
Threat name:
Win32.Trojan.Phonzy
Create hunting rule
Status:
Malicious
First seen:
2021-02-22 06:38:11 UTC
AV detection:
8 of 47 (17.02%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l2fqbfxkbvxgbxe73lq4e3ydq43vrdibisu5xilsgip2uwre7drq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

uue 5e8b0096ea0d6e60dc9fdae1c26f038737588d0144a9dba172321faa5a24f8e3

(this sample)

NanoCore

Executable exe 9af6ee7679b5e12c34b0530a2b7639c65b1ff8449930ed9a6156338a2eebbb98

  
Dropping
MD5 988bbc4bf9b82be5dfa915ecb1b63c49
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9af6ee7679b5e12c34b0530a2b7639c65b1ff8449930ed9a6156338a2eebbb98

Comments