MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 867f2e2e8bb844b52bd453b23ac05317fa5002afad6ea7c37a18681a9e93d8e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 867f2e2e8bb844b52bd453b23ac05317fa5002afad6ea7c37a18681a9e93d8e2
SHA3-384 hash: b24e0801920f26f5b562d2e88a9056903c45ee7035b7ba2d80c4e95c93269d4902619e9547676e47a4c7aa2b5397ce1f
SHA1 hash: 0ddb561f1a4fbae178d24fde543f9a9e75654b2a
MD5 hash: 573033d8b28e4f3f3791af1b5d8bc2b6
humanhash: eight-nuts-nuts-coffee
File name:DHL-AWB130501923096PDF.ISO
Download: download sample
Signature NanoCore
Create hunting rule
File size:307'470 bytes
First seen:2020-05-27 08:51:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:0H4Ylf8o481Na00zalDmt7+CAXzJErIsXVbdor7cY5391:0YYWo481NEwmp+CAXzOxddYF91
TLSH EB6423A7D038AF333BFA1744258E53466587F585D958CDA8323CDF2E41B8DA229B70D8
Reporter abuse_ch
Tags:DHL iso NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: dhl.com
Sending IP: 172.106.111.224
From: DHL <myclearance@dhl.com>
Subject: 需要采取的行动 - Please Confirm Your Shipment Address
Attachment: DHL-AWB130501923096PDF.ISO (contains "DHL-#AWB130501923096PDF.exe")

NanoCore RAT C2:
boss2020.ddns.net:6789 (185.140.53.25)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@FOS-VPN.org'

inetnum: 185.140.53.0 - 185.140.53.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.140.53.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU
org: ORG-SL751-RIPE
admin-c: SL12644-RIPE
tech-c: SL12644-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-04-06T18:59:49Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-27 09:07:30 UTC
File Type:
Binary (Archive)
Extracted files:
4
AV detection:
14 of 30 (46.67%)
Threat level:
  2/5
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 867f2e2e8bb844b52bd453b23ac05317fa5002afad6ea7c37a18681a9e93d8e2

(this sample)

NanoCore

Executable exe f7c4e512aa4f7f6155bc60a66f9b051f6ceef87f8064e195666798ab637b2cb6

  
Dropping
MD5 9c7555ebf69be5ca19f6a1f399838fef
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f7c4e512aa4f7f6155bc60a66f9b051f6ceef87f8064e195666798ab637b2cb6

Comments