MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6dc80d2357dd691bd6d71bec96704c44fb37e1f91a77e6935b9a247b8cbb5cb7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6dc80d2357dd691bd6d71bec96704c44fb37e1f91a77e6935b9a247b8cbb5cb7
SHA3-384 hash: 0f85a3fb7e0e91e0b33f0c71ae3342c20b81f2bfe854cffe06c883af1971d037bdd09388e9853ed53ff7b44970001c18
SHA1 hash: 702d791ce1200ff71ffebca2d0e64170faf66dea
MD5 hash: 257d45333cc98cf13b9efd5dc8c23ccd
humanhash: kitten-blue-social-fanta
File name:SwiftCopy 82938833.PDF.gz
Download: download sample
Signature NanoCore
Create hunting rule
File size:615'715 bytes
First seen:2020-08-04 11:21:14 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:Sz0NiPFxGZRYvtGpBOTBzit6d437q/vb9CWxoPrntBIOCoq0OCnNMNWLBpJ:LNgF4ZRWGpBOTBziU4mXb9Cv8OCoq828
TLSH 67D423E1A24711C5297A07CB712C5BC25E35DC6B94708CA9BA10C9BF847530EEF4EB2B
Reporter abuse_ch
Tags:gz NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: mailblock3.hostneverdie.com
Sending IP: 27.254.41.200
From: Ms. Pranayi Sumanti <webster@citofoniarintec.cl>
Reply-To: purchase-team@citofoniarintec.cl
Subject: Re: Outstanding invoice settlement.
Attachment: SwiftCopy 82938833.PDF.gz (contains "SwiftCopy #82938833.exe")

NanoCore RAT C2:
apaduckdns.duckdns.org:54984

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6dc80d2357dd691bd6d71bec96704c44fb37e1f91a77e6935b9a247b8cbb5cb7/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-04 11:23:04 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nxea2i2x3vurxvwxdpwjm4cmit5tpypzdj36ne23tishxdf3ls3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6dc80d2357dd691bd6d71bec96704c44fb37e1f91a77e6935b9a247b8cbb5cb7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

gz 6dc80d2357dd691bd6d71bec96704c44fb37e1f91a77e6935b9a247b8cbb5cb7

(this sample)

NanoCore

Executable exe d28c4fc79cac0d44f25cd239bf3efbcb8185b25850ba4aafecfdd988af23bbc0

  
Dropping
MD5 722c2d9bccd815e51f48c7013787e5ef
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 d28c4fc79cac0d44f25cd239bf3efbcb8185b25850ba4aafecfdd988af23bbc0

Comments