MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7881c3494956f06e15b4a99db056a31609b0e52de993d7d53c84b7ee5cb9411f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7881c3494956f06e15b4a99db056a31609b0e52de993d7d53c84b7ee5cb9411f
SHA3-384 hash: e0b3ee0fe07af99e7e37e0be705474eed5350b22e7503f35a41ca52d247f4158222e00ad84859f7e576ed4b9e9792749
SHA1 hash: 24ff0e935beb873b88c3ffc4947f938e22147b08
MD5 hash: 7b68721a062886ad22a1577ec543ff6d
humanhash: west-single-arkansas-harry
File name:Shiping Doc BL.PDF.z
Download: download sample
Signature NanoCore
Create hunting rule
File size:304'823 bytes
First seen:2021-01-01 18:47:33 UTC
Last seen:Never
File type: z
MIME type:application/x-rar
ssdeep 6144:G1gCAU/hWuymMJyCSzCoK+AIyWkQaeF7GyVqRnKQvEzuqc2LYxKVt:G1TAUZHymMM+oKtMF7qzquqcTU
TLSH 8B54237D2271D8220D5B43909A3FB9588C4E24D7BAC4CBAB59F376C4A352F6F1073246
Reporter abuse_ch
Tags:NanoCore nVpn RAT TNT z


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: server.pandemicreety.tk
Sending IP: 193.168.3.223
From: TNT EXPRESS INC <info@pandemicreety.tk>
Subject: Consignment Notification: You have A Package With Us
Attachment: Shiping Doc BL.PDF.z (contains "Shiping Doc BL.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
251
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7881c3494956f06e15b4a99db056a31609b0e52de993d7d53c84b7ee5cb9411f/
Threat name:
Win32.Backdoor.Remcos
Create hunting rule
Status:
Malicious
First seen:
2021-01-01 18:48:05 UTC
AV detection:
17 of 47 (36.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pca4gskjk3yg4fnuvgo3avvdcye3bzjn5gj5pvj4qs364xfziepq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7881c3494956f06e15b4a99db056a31609b0e52de993d7d53c84b7ee5cb9411f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

z 7881c3494956f06e15b4a99db056a31609b0e52de993d7d53c84b7ee5cb9411f

(this sample)

NanoCore

Executable exe ea6b74e2f0364ce1b058b8f5d7c078c3f47cb61a546976a5d56e0378c029892c

  
Dropping
MD5 a0522b3fe3130794e171fa99ad13e5bf
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ea6b74e2f0364ce1b058b8f5d7c078c3f47cb61a546976a5d56e0378c029892c

Comments