MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a88da432201bddf63c6468d7ab3cd2a69f29e222c6c7543fd8c4a0b6ae75f66a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 2

Intelligence 2 IOCs YARA File information Comments

SHA256 hash:	a88da432201bddf63c6468d7ab3cd2a69f29e222c6c7543fd8c4a0b6ae75f66a
SHA3-384 hash:	ee7a5fe8ae24d8c35690d36979539b05b14131d402af6783066c6f74fda2ae65bf8c72941c4cb92b2fcad661c9e6fcf3
SHA1 hash:	b1db64b5e8d7aeba685e01022367a99570a45921
MD5 hash:	342a867124ef8c3cc7bf09d9c348736b
humanhash:	oklahoma-alpha-burger-fourteen
File name:	Incentive Doc.rar
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	359'314 bytes
First seen:	2020-08-16 14:05:55 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	6144:/bNjDZcE7MRa8PuprCzUXWnR0TC4pnQ43SNLKrAiUzh31aaPtXRBuKTd:BjFVAxYXeSC8d3SZKsiURLZLuKTd
TLSH	EE7423EAD79F8207E51DD362B1C4578212408F5CD32A6BAE71FA4705B10F637D983B86
Reporter	abuse_ch
Tags:	NanoCore nVpn rar RAT

abuse_ch

Malspam distributing NanoCore:

HELO: gmail.com
Sending IP: 81.171.9.143
From: Sherbin Thomas <chomi0605@panpacific.co.kr>
Reply-To: Sherbin Thomas <surnit9041@gmail.com>
Subject: LM Approved Invoices 08/15/20
Attachment: Incentive Doc.rar (contains "Incentive Doc.exe")

NanoCore RAT C2:
masterwork.ydns.eu:2310 (194.5.98.5)

Pointing to nVpn:

% Information related to '194.5.98.0 - 194.5.98.255'

% Abuse contact for '194.5.98.0 - 194.5.98.255' is 'abuse@privacyfirst.sh'

inetnum: 194.5.98.0 - 194.5.98.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU6
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-04-26T16:42:54Z
last-modified: 2020-07-30T03:41:26Z
source: RIPE