MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9b5b6fb46ea5a907b5933d634ee8c18d0c1c3a446ce7ca611d58a225fb54aad1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9b5b6fb46ea5a907b5933d634ee8c18d0c1c3a446ce7ca611d58a225fb54aad1
SHA3-384 hash: b805711dfcaf9cf3b2f350b48d5f682bb915c0155a2b42cb2be5e73c105d677115d40603f50eae416b0a702ecc32122f
SHA1 hash: 0c771a3266fdfce727056786faa68c9b0a06e8f5
MD5 hash: 7f86c93839e9265e53ed4905ec3913a0
humanhash: low-montana-foxtrot-black
File name:Ordine R20 T4077 TBA 2020, pdf.xz
Download: download sample
Signature NanoCore
Create hunting rule
File size:595'785 bytes
First seen:2020-10-27 10:24:32 UTC
Last seen:Never
File type: xz
MIME type:application/x-rar
ssdeep 12288:7MSKztg3jGdawiJ6FziwO5uqdyUK/vXlMCaqqr5MIt:oOCd1dFOj5uqfK3XDUGIt
TLSH 40C43322FDBD3A82A22013F038CF1E7E69F9364244AFDBF5847357263498565E94139E
Reporter abuse_ch
Tags:NanoCore nVpn RAT xz


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: mail.nipponcarsrl.com.ar
Sending IP: 200.114.86.103
From: Aurora Rossi <info@filtertechnics.it>
Subject: Ordine R20-T4077 /TBA-2020
Attachment: Ordine R20 T4077 TBA 2020, pdf.xz (contains "Ordine R20 T4077 TBA 2020, pdf.exe")

NanoCore RAT C2:
graceland777.ddns.net:7771 (185.140.53.129)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@privacyfirst.sh'

inetnum: 185.140.53.0 - 185.140.53.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-BE
country: BE
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-10-02T20:59:33Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
141
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27342.RarHeur.v5.HideExt.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9b5b6fb46ea5a907b5933d634ee8c18d0c1c3a446ce7ca611d58a225fb54aad1/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tnnw7ndouwuqpnmthvru52gbrugbyosentt4uyi5lcrcl62uvliq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

xz 9b5b6fb46ea5a907b5933d634ee8c18d0c1c3a446ce7ca611d58a225fb54aad1

(this sample)

NanoCore

Executable exe 3459d3a07659440f0e31b4b59a53a6ed78914d64a467cab3dcd05de1555c1488

  
Dropping
MD5 93a661f911630ce9b4436a86fdd40b91
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 3459d3a07659440f0e31b4b59a53a6ed78914d64a467cab3dcd05de1555c1488

Comments