MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 978765d940072e368938950ece7dd894c023270adc7fd22456fccabcf5c2b5ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 978765d940072e368938950ece7dd894c023270adc7fd22456fccabcf5c2b5ad
SHA3-384 hash: 2bba2568e5f542966ab50ef9918adf875b5b59a7b66fc9e8617b73b9f93b6fb848262f3c58e3084952eafc772e5f2d86
SHA1 hash: 44210b41331d294ed3316865f11cd051e0021f20
MD5 hash: de0ade6c12de08acc3d31bcf33ca736b
humanhash: whiskey-stream-nine-whiskey
File name:PO-TSP-7320051.IMG
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'638'400 bytes
First seen:2020-06-29 12:20:57 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:hjnGLjIup+Q67pPhPc3IAMXOvIHoFdDRVmqOJ1UVSxk+AIWNDoKj3gbQZw:hjoUuGNhPc3uOIoScVSO5n3w9
TLSH 19758D2EF28E5433E1B256389C3B5375983ABD103D2858467BE9CD6C5F3968338352A7
Reporter abuse_ch
Tags:img NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: mail.strongmailvault.com
Sending IP: 111.90.144.75
From: Waleed Rashid <office@jinpao.us>
Reply-To: info.farapan19@gmail.com
Subject: Order confirmation needed PO-TSP-732
Attachment: PO-TSP-7320051.IMG (contains "hhhesda.exe")

NanoCore RAT C2:
79.134.225.75:21600

Hosted on nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Webalta-6854075-0
Create hunting rule

PUA.Win.Adware.Webalta-6862190-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/978765d940072e368938950ece7dd894c023270adc7fd22456fccabcf5c2b5ad/
Threat name:
Win32.Trojan.Zusy
Create hunting rule
Status:
Malicious
First seen:
2020-06-29 12:22:05 UTC
AV detection:
11 of 48 (22.92%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s6dwlwkaa4xdncjysuhm47oystacgjyk3r75ejcw7tflz5ocwwwq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

img 978765d940072e368938950ece7dd894c023270adc7fd22456fccabcf5c2b5ad

(this sample)

NanoCore

Executable exe aee0158a9f836306b64e6c99e732073aa81fe23944c91a3d0fcf9a92508019ec

  
Dropping
MD5 51419d0dbc446c8dc61aedfaa6712a5b
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 aee0158a9f836306b64e6c99e732073aa81fe23944c91a3d0fcf9a92508019ec

Comments