MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9051429f532c5d33551f5f1696b1d17dee7190acb06820b82088f43134da3bfb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9051429f532c5d33551f5f1696b1d17dee7190acb06820b82088f43134da3bfb
SHA3-384 hash: 4d451284ce19ea7245d4b0ae70ad3ef3919de61f9f6baf06fe53cb73b575e4f806c2ccdcbbe49750f95b2a182d8f153b
SHA1 hash: e6f85ea6182be5036927a723c5160b9713a919f2
MD5 hash: 6fcc95ed320f74d8431558deefb1f8b6
humanhash: august-mexico-twenty-fifteen
File name:New Order_1132012_xlxs.gz
Download: download sample
Signature NanoCore
Create hunting rule
File size:585'132 bytes
First seen:2021-01-13 20:17:20 UTC
Last seen:Never
File type: gz
MIME type:application/x-rar
ssdeep 12288:0JDg2s3V9F+9AQG4vDY3NfjApeaUmtwinS+ri/VSpl6tLu4rRt9jrJm:0Jzs3V/+9AQG4vs3NIecrSUi/9LuOt9I
TLSH A4C423A90BB91408784C79467E5172D9F597FD3EE6B35104B070C6BEB2CF8B4EE16680
Reporter abuse_ch
Tags:gz NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: srv.prodestek.com
Sending IP: 213.159.0.246
From: Sales <ankara@umguysal.com>
Reply-To: ankara@umguysal.com
Subject: FW: Enquiry
Attachment: New Order_1132012_xlxs.gz (contains "New Order_1132012_xlxs.exe")

NanoCore RAT C2:
185.140.53.251:1995

Intelligence

File Origin
# of uploads :
1
# of downloads :
196
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9051429f532c5d33551f5f1696b1d17dee7190acb06820b82088f43134da3bfb/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-13 20:18:18 UTC
AV detection:
15 of 46 (32.61%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=sbiufh2tfrotgvi7l4ljnmorpxxhdefmwbucbobard2dcng2hp5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9051429f532c5d33551f5f1696b1d17dee7190acb06820b82088f43134da3bfb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

gz 9051429f532c5d33551f5f1696b1d17dee7190acb06820b82088f43134da3bfb

(this sample)

NanoCore

Executable exe 80d727cce7ca79da42e564afa636a5d023353bd7f87f9b5328038d8d3c4f071a

  
Dropping
MD5 1dc30f0b34a4f0d1404dc25a1cd54f6e
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 80d727cce7ca79da42e564afa636a5d023353bd7f87f9b5328038d8d3c4f071a

Comments