MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7e73b069c3bec157bf1bfa1b617954bf90d43a433f8f79fede11cae95e33152e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7e73b069c3bec157bf1bfa1b617954bf90d43a433f8f79fede11cae95e33152e
SHA3-384 hash: c15afabe630bc2bb90c8b1f1046b4a276f37cdf5ffdc91b5f8471c726e6c7555c783c658413662a256a04c31af39dc22
SHA1 hash: 89844caad4f96e42ebeb58fa0291b1e4c872b176
MD5 hash: 5e0ae8b947df21e04403a795a1b2f6fa
humanhash: enemy-queen-artist-robert
File name:Credit Notification PDF.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:544'448 bytes
First seen:2021-02-01 12:15:05 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:x6SyoZfPL1cfpGzqEwb8vDCJMz0kHB5rSpiRfmqSf:EEL0Ewb87CJEhGiRfmJf
TLSH 17C423A162C6862ED06181BBF1BC1BA5D524FF220FC1D37ED2372F0992EBA520596073
Reporter abuse_ch
Tags:NanoCore rar RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

From: Accounts <dbeery@3oaksretreat.com>
Subject: Re: MISTAKEN PAYMENT
Attachment: Credit Notification PDF.rar (contains "Swift Copy PDF.exe")

NanoCore RAT C2:
mnvh54254.ddns.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7e73b069c3bec157bf1bfa1b617954bf90d43a433f8f79fede11cae95e33152e/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-01 12:16:06 UTC
AV detection:
11 of 44 (25.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=pzz3a2odx3avppy37inwc6kux6iniosdh6hxt7w6chfosxrtcuxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7e73b069c3bec157bf1bfa1b617954bf90d43a433f8f79fede11cae95e33152e

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 7e73b069c3bec157bf1bfa1b617954bf90d43a433f8f79fede11cae95e33152e

(this sample)

NanoCore

Executable exe ae8f19f4c25c2bd27976d4c2c90a9be02058f31fcefdefe29aaff3804d37e5e4

  
Dropping
MD5 e770848ef1da42d86626a6b6c050a5ce
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ae8f19f4c25c2bd27976d4c2c90a9be02058f31fcefdefe29aaff3804d37e5e4

Comments