MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79a902eb238376b609f9ed12dcdf60ee7147ebb867e9bf87475f9a2e054e9716. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79a902eb238376b609f9ed12dcdf60ee7147ebb867e9bf87475f9a2e054e9716
SHA3-384 hash: c313961a482049e9f6232e3f244d1549470f58a9e231becf8c88fb8054f6b1044fab8a5f95f7ef4cdd02bfc4a861c8b0
SHA1 hash: af1cfa196d8e2951cb92ca1720f9f900e26ffa12
MD5 hash: b1391f908cdc682524124f79212c733c
humanhash: happy-mango-stairway-iowa
File name:Estado de cuenta.img
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'245'184 bytes
First seen:2020-08-13 14:38:43 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:BS1FFkBGs5bc5tHBonRQ11OpP6xc0wYSqVqGGGGGGDGGGGGGgyFw674RoGGGGGGg:BS1zkkNtheQ6YA7Y
TLSH 0145F6E2F6455C99EC1717F1193A9A6010736E6D59E4820C30BE7E6737B338324AAD8F
Reporter abuse_ch
Tags:ESP geo img NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: mail.jaroma.com.ec
Sending IP: 186.5.88.211
From: recepcion.documentos@jaroma.com.ec
Subject: Estado de cuenta
Attachment: Estado de cuenta.img (contains "Estado de cuenta.scr")

NanoCore RAT C2:
jrandjcpa.org:6969 (194.5.98.205)

Pointing to nVpn:

% Information related to '194.5.98.0 - 194.5.98.255'

% Abuse contact for '194.5.98.0 - 194.5.98.255' is 'abuse@privacyfirst.sh'

inetnum: 194.5.98.0 - 194.5.98.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU6
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-04-26T16:42:54Z
last-modified: 2020-07-30T03:41:26Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.MSIL.Vuvazi.8.2.5137.26991.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79a902eb238376b609f9ed12dcdf60ee7147ebb867e9bf87475f9a2e054e9716/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-13 14:40:13 UTC
AV detection:
14 of 29 (48.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pguqf2zdqn3lmcpz5ujnzx3a5zyup25ym7u37b2hl6nc4bkos4la._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
0.70
Link:
https://yomi.yoroi.company/submissions/79a902eb238376b609f9ed12dcdf60ee7147ebb867e9bf87475f9a2e054e9716

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

img 79a902eb238376b609f9ed12dcdf60ee7147ebb867e9bf87475f9a2e054e9716

(this sample)

NanoCore

Executable exe 6f8b5cad56d107434291b260c5483479d0ac1d02498d5bfad7468a02dc7fc19d

  
Dropping
MD5 c7a6ac1256af10196dc1adbe84abe700
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6f8b5cad56d107434291b260c5483479d0ac1d02498d5bfad7468a02dc7fc19d

Comments