MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 620756f3777b15a9d1786c659be1582a98d799db87c58fc85acf0e4b67ed9f19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 620756f3777b15a9d1786c659be1582a98d799db87c58fc85acf0e4b67ed9f19
SHA3-384 hash: 8c9706a02c935ac5a02ef0f5cd5c5bac07aeb856c303ae937a80e451eab1efec1eb15ef9fe3ff4f7e030b2d3551ccf47
SHA1 hash: e7ee28ff437be196ff996b6cbfa313d591766c3a
MD5 hash: 9a0076865f82aa9e8dbf24bea2421fda
humanhash: kentucky-oscar-arizona-tennis
File name:ODEME.uue
Download: download sample
Signature NanoCore
Create hunting rule
File size:928'594 bytes
First seen:2020-05-28 08:36:17 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 24576:KBQruK691xQopD5pTyxj/zbdDUlJmoEf2pAt:KBQruKs1qoBTyxDRQEf2Kt
TLSH 4615331F98875AA7E31BCA223B8F9484114778F3364677A0E237B157CE0FB1D056DA89
Reporter abuse_ch
Tags:geo NanoCore nVpn RAT TUR uue


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: server.svetaine123.lt
Sending IP: 109.235.71.104
From: ZIRAAT BANKASI. <ziratbank@ileti.ziraatbank.com.tr>
Reply-To: epolleg44@gmail.com
Subject: Dis Ticaret Transferi Hakkinda!
Attachment: ODEME.uue (contains "ODEME.scr")

NanoCore RAT C2:
jege1.duckdns.org:2025 (79.134.225.74)

Pointing to nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Trojan.Predator
Create hunting rule
Status:
Malicious
First seen:
2020-05-28 09:36:10 UTC
File Type:
Binary (Archive)
Extracted files:
17
AV detection:
14 of 31 (45.16%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

uue 620756f3777b15a9d1786c659be1582a98d799db87c58fc85acf0e4b67ed9f19

(this sample)

NanoCore

Executable exe b0896cbac640a28e5f9f597d546534fb06175652f6c8d4232b65b22a1743be51

  
Dropping
MD5 da4227dcfbc095e138deac5e6f7ee1f1
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 b0896cbac640a28e5f9f597d546534fb06175652f6c8d4232b65b22a1743be51

Comments