MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa462c7beaee602929b5a4bcf024d50e08efad9cbcc1b13b78cbbaa5db20c4b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa462c7beaee602929b5a4bcf024d50e08efad9cbcc1b13b78cbbaa5db20c4b9
SHA3-384 hash: 3b36839efaf804e12074db827f4b9da28858fa2f61535be6a10cfdaa517163c13ed9c7d38baa9371b4a50421afaec700
SHA1 hash: be7aacc571d86b21839fc10d26fea86022706fef
MD5 hash: e539cf291445460919c5406279ec6137
humanhash: winner-minnesota-carolina-colorado
File name:ZODAX BOOKING ADVISE-SHA-TOP HARVEST.r00
Download: download sample
Signature NanoCore
Create hunting rule
File size:438'046 bytes
First seen:2021-03-05 13:07:07 UTC
Last seen:Never
File type: r00
MIME type:application/x-rar
ssdeep 12288:fNCzw84OleVEgzDhHh9t0Mj2BO0i+8nJS9:fNIwElwEgzDhHh9BKM0i+8S9
TLSH 699423A07386E83B20C4D9F30916C8ED587327148B4D5BC156C5EAED31B7A17E385EA8
Reporter abuse_ch
Tags:NanoCore r00 RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: slot0.guniabaers.com
Sending IP: 194.31.96.135
From: sales@premiumsystem.com.my
Subject: 21FAR019 - ZODAX PO#46980 - Shanghai port
Attachment: ZODAX BOOKING ADVISE-SHA-TOP HARVEST.r00 (contains "ZODAX BOOKING ADVISE-SHA-TOP HARVEST.exe")

NanoCore RAT C2:
dowas.hopto.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
209
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa462c7beaee602929b5a4bcf024d50e08efad9cbcc1b13b78cbbaa5db20c4b9/
Threat name:
ByteCode-MSIL.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-03-05 03:09:42 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vjdcy67k5zqcsknvus6pajgvbyeo7lm4xta3co3yzo5klwzays4q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/aa462c7beaee602929b5a4bcf024d50e08efad9cbcc1b13b78cbbaa5db20c4b9

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

r00 aa462c7beaee602929b5a4bcf024d50e08efad9cbcc1b13b78cbbaa5db20c4b9

(this sample)

NanoCore

Executable exe 8352c44e579db255fe3ac2e5821ff0cf932822d3851ab555f2fe54531c7e427e

  
Dropping
MD5 dda8392daba5c7cde9e1c7ad4544cb16
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8352c44e579db255fe3ac2e5821ff0cf932822d3851ab555f2fe54531c7e427e

Comments