MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a0a310864680dc16bc72c2220043b59ac8241693308098384d15381ceaa866e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a0a310864680dc16bc72c2220043b59ac8241693308098384d15381ceaa866e
SHA3-384 hash: 059ed30f02f6f1da991a3bc105c8a6cdffb3979aa0f0fc7677c1cca94640a4d51ee63836ff2db11bc8d8a0b71d63ed7e
SHA1 hash: de13041f1bbbe1fe3fdd2ede0eed449097855bbc
MD5 hash: ab84fd59427725efb5a0b0c31a6be5b5
humanhash: network-two-quiet-asparagus
File name:POEA ADVISORY NO 450 2021.uue
Download: download sample
Signature NanoCore
Create hunting rule
File size:581'693 bytes
First seen:2021-02-18 07:39:21 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 12288:vUYBn4n/O2Xgwr6MZroSZ5+SzU65CH/QIx0DS0030PdoJP:h45ISZISzUP/50L002
TLSH B5C423C72B4AC171B73FF1852B3F5D09C609941B6F8A1D0C41BB39B9DA76C72A8E50A1
Reporter abuse_ch
Tags:geo NanoCore PHL POEA RAT uue


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: sd.latticesystems.com
Sending IP: 204.152.206.90
From: Philippine Overseas Employment Administration <info1@poea.gov.ph>
Subject: POEA MEMORANDUM
Attachment: POEA ADVISORY NO 450 2021.uue (contains "POEA ADVISORY NO 450 2021.pdf.exe")

NanoCore RAT C2:
shahzad73.casacam.net:9036

Intelligence

File Origin
# of uploads :
1
# of downloads :
122
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a0a310864680dc16bc72c2220043b59ac8241693308098384d15381ceaa866e/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-18 07:40:07 UTC
AV detection:
7 of 47 (14.89%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nifdccdenag4c26hfqrcabb3lgwieqljgmeata4e2fjydtvkqzxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6a0a310864680dc16bc72c2220043b59ac8241693308098384d15381ceaa866e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

uue 6a0a310864680dc16bc72c2220043b59ac8241693308098384d15381ceaa866e

(this sample)

NanoCore

Executable exe cff7917b775748ad82f20fede03809e1cf8d186747d82c5bbd5f4bf0a2c6ae32

  
Dropping
MD5 844a5401ecb97ca4b3eb72421330c524
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cff7917b775748ad82f20fede03809e1cf8d186747d82c5bbd5f4bf0a2c6ae32

Comments