MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 76299e863b71caed1b9950d904d1b52a8174b9077c9d4bc896276881caa46fad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
NanoCore
Vendor detections: 4
| SHA256 hash: | 76299e863b71caed1b9950d904d1b52a8174b9077c9d4bc896276881caa46fad |
|---|---|
| SHA3-384 hash: | a00a7a06879ee92dc38f064b632d983e3063c29f7e8f297c2f65d2be1066fc35634920cbe0a993f7557265f730c8425e |
| SHA1 hash: | ec39ceb613ab83b05ecc514b4b928772d51226ac |
| MD5 hash: | cb1452b946d82254a54e0cb30567cc5a |
| humanhash: | colorado-failed-cold-white |
| File name: | COVID-19VACCINE____________________________________________.exe |
| Download: | download sample |
| Signature | NanoCore |
| File size: | 668'403 bytes |
| First seen: | 2020-04-11 17:37:12 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 027ea80e8125c6dda271246922d4c3b0 (10 x njrat, 7 x DCRat, 5 x DarkComet) |
| ssdeep | 12288:Fhxp3lZnT9bDluF3+GuLMDPcsoSDg9UKLHto:FJlh9bDsFtE93G |
| Threatray | 1'332 similar samples on MalwareBazaar |
| TLSH | 54E4AD4171C5E8F2D42319B1DD39BBF0292E7DA8D5248E0F3A877D1EB9B21522036A5F |
| Reporter |  abuse_ch |
| Tags: | COVID-19 exe NanoCore nVpn RAT |
abuse_ch
COVID-19 themed malspam distributing NanoCore RAT:HELO: business64-3.web-hosting.com
Sending IP: 198.187.31.71
From: World Health Organization Int. <nitheesh@mailconsuilt.site>
Subject: Fwd: COVID-19 Vaccine and Treatment
Filename: COVID-19 VACCINE____________________________________________.exe
NanoCore RAT C2:
arinnnnnnnn.ddns.net
Resolves to nvpn:
% Information related to '185.140.53.0 - 185.140.53.255'
% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@FOS-VPN.org'
inetnum: 185.140.53.0 - 185.140.53.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.140.53.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU
Intelligence
File Origin
# of uploads :
1
# of downloads :
126
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Nanocore
Status:
Malicious
First seen:
2020-04-11 18:38:00 UTC
File Type:
PE (Exe)
Extracted files:
24
AV detection:
28 of 31 (90.32%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Label(s):
nanocorerat
Similar samples:
+ 1'322 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
BLint
The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.
Findings
| ID | Title | Severity |
|---|---|---|
| CHECK_AUTHENTICODE | Missing Authenticode | high |
| CHECK_DLL_CHARACTERISTICS | Missing dll Security Characteristics (HIGH_ENTROPY_VA) | high |
Reviews
| ID | Capabilities | Evidence |
|---|---|---|
| WIN32_PROCESS_API | Can Create Process and Threads | KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread |
| WIN_BASE_API | Uses Win Base API | KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryExA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoW |
| WIN_BASE_EXEC_API | Can Execute other programs | KERNEL32.dll::AllocConsole KERNEL32.dll::AttachConsole KERNEL32.dll::WriteConsoleW KERNEL32.dll::FreeConsole KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode |
| WIN_BASE_IO_API | Can Create Files | KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW KERNEL32.dll::CreateFileW KERNEL32.dll::CreateFileMappingW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW KERNEL32.dll::MoveFileExW |
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.