MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 646520a68d13313e8db10e94a04eb3940fffca130fa4ddf2b8d4cb28c3ac0fd0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	646520a68d13313e8db10e94a04eb3940fffca130fa4ddf2b8d4cb28c3ac0fd0
SHA3-384 hash:	2274ceb842266cff75d135c8c9e173b70c9e8c526540c34d6e25013d4a8cb1e27d3050209ff4f24a95059cdc9762f225
SHA1 hash:	4c1bdc17eb1b8f99a061d72c25598810d306697b
MD5 hash:	3fbc3b7fc9fbf4a1c4984a4cefd58bd8
humanhash:	black-kansas-pasta-enemy
File name:	Doc_0720_442.pdf.zip
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	423'220 bytes
First seen:	2020-07-20 09:27:45 UTC
Last seen:	2020-07-22 07:09:50 UTC
File type:	zip
MIME type:	application/zip
ssdeep	12288:P1Ngbqi9RwMiP6rJJthi0ERxw1FWq3afTsv:PkR9bjjDR+C
TLSH	829423D5D778332F908014574F9A9E8CB4AF8CECA48D01FCF704BDB165EA879AA30469
Reporter	abuse_ch
Tags:	NanoCore nVpn RAT zip

abuse_ch

Malspam distributing NanoCore:

HELO: jmigroup-bd.com
Sending IP: 37.49.230.190
From: Procurement @ Singatac <procurement@singatac.com.sg>
Subject: PO-PS20-0254
Attachment: Doc_0720_442.pdf.zip (contains "Doc_0720_442.exe")

NanoCore RAT C2:
izu2128.hopto.org:2128 (185.244.29.131)

Pointing to nVpn:

% Information related to '185.244.29.0 - 185.244.29.255'

% Abuse contact for '185.244.29.0 - 185.244.29.255' is 'abuse@privacyfirst.sh'

inetnum: 185.244.29.0 - 185.244.29.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-KP
country: KP
descr: Wonsan, Kangwon-do
descr: Choson Minjujuui Inmin Konghwaguk
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: SUB-ALLOCATED PA
mnt-by: PRIVACYFIRST-MNT
created: 2018-01-31T19:41:57Z
last-modified: 2020-07-14T13:29:24Z
source: RIPE