MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b85c28f811a244d3824ed357222397ce31e49a5068a4d86afb4331f8dec0917. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b85c28f811a244d3824ed357222397ce31e49a5068a4d86afb4331f8dec0917
SHA3-384 hash: 23515d43477fd7eff366199920a56e4a9e94ee06eea09646afc779356fc6f6c032a6165f0cd74e07ac7bfe0fb6c12356
SHA1 hash: 352ecfad4181f128e64936e27aa125e4eadb9c9f
MD5 hash: 36b97f36dcb06539cfd680aa3ddd7334
humanhash: failed-speaker-green-fix
File name:Quotation Request_RFQ_25_05_2020.iso
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'359'872 bytes
First seen:2020-05-25 15:22:06 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:ctb20pkaCqT5TBWgNQ7aUQTgLV3/XY/13etDDlI8UULQH6A:FVg5tQ7aUQTgpXY13QDlIHU25
TLSH 7355D01273DEC365C3B25273BA15B701AEBF782506B5F56B2FD8093DAA20122521E773
Reporter abuse_ch
Tags:iso NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: di.digitalby.live
Sending IP: 45.95.171.220
From: Kadant Lamort Co.,Ltd <info@digitalby.live>
Subject: Quotation Request_#RFQ_25_05_2020
Attachment: Quotation Request_RFQ_25_05_2020.iso (contains "Quotation Request_#RFQ_25_05_2020.exe")

NanoCore RAT C2:
baddest101.ddns.net:1940 (79.134.225.75)

Pointing to nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 15:35:46 UTC
File Type:
Binary (Archive)
Extracted files:
27
AV detection:
15 of 31 (48.39%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

iso 7b85c28f811a244d3824ed357222397ce31e49a5068a4d86afb4331f8dec0917

(this sample)

NanoCore

Executable exe 6c775aa70b8dadbb9725cab1c2de67c64eac6c019537d2540eb37d6b2fb7af4c

  
Dropping
MD5 b3582cda9d0f96fb30f0e7bf40665d7c
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 6c775aa70b8dadbb9725cab1c2de67c64eac6c019537d2540eb37d6b2fb7af4c

Comments