MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a078bd532d3dd20f47104f8b8a24cb6fc5b007f0373a117e6108c5e5b8e18aa1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	a078bd532d3dd20f47104f8b8a24cb6fc5b007f0373a117e6108c5e5b8e18aa1
SHA3-384 hash:	d56c72ddcc3b4b0e1d45fac4fd3643e87924abdd5b35d497f1ffc1d902ad3b7ab17aa93ff25ced5b472a4a0ce374f988
SHA1 hash:	2bc665dba1ae0020f7d161f455814a0f3d0f54bb
MD5 hash:	f322948147e5f21d79405b76e089d8f8
humanhash:	xray-network-timing-eight
File name:	Doc_72020_437.pdf.zip
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	423'358 bytes
First seen:	2020-07-20 09:08:49 UTC
Last seen:	2020-07-20 10:39:40 UTC
File type:	zip
MIME type:	application/zip
ssdeep	6144:o2N+yReLcWrDwWl/i7QKoMquIL7MUZjkbHyxJJFJeMOGwK7ncllhF/mqWWsVr:TXReLnwq/i7QKoMFIH6KrOsm1/mZr
TLSH	CF9423CE495E7D58F6EAB3C88819CEC27A4880FC3E14432D0C86E9DDE1D29971AB5351
Reporter	abuse_ch
Tags:	NanoCore nVpn RAT zip

abuse_ch

Malspam distributing NanoCore:

HELO: diabos.biz
Sending IP: 45.143.222.165
From: George Drumitrascu <office@dacorom.ro>
Subject: Re: New RFQ
Attachment: Doc_72020_437.pdf.zip (contains "Doc_72020_437.exe")

NanoCore RAT C2:
wazzy.ddns.net:1716 (79.134.225.75)

Pointing to nVpn:

% Information related to '79.134.225.0 - 79.134.225.127'

% Abuse contact for '79.134.225.0 - 79.134.225.127' is 'abuse@privacyfirst.sh'

inetnum: 79.134.225.0 - 79.134.225.127
netname: PRIVACYFIRST-EU
country: EU
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
org: ORG-TPP6-RIPE
created: 2020-07-14T15:26:02Z
last-modified: 2020-07-14T15:31:06Z
source: RIPE