MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aabb0dd4fec420a2b4eef5773d098cae314568ffb403cbad4c0228d4c6cd8d47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aabb0dd4fec420a2b4eef5773d098cae314568ffb403cbad4c0228d4c6cd8d47
SHA3-384 hash: f1a10ba75f571ede8e2a0ffe3dd96b2ae39b7c5f3e6fde678ca346dd909b54c829d669fcd67009cb4bf68421fee77b55
SHA1 hash: 318dcdf0ae6c37dcf84b97f785c8af9966200b60
MD5 hash: b8c0fcca908c761afc89bb81010637d8
humanhash: kentucky-solar-delta-kitten
File name:20200610dc.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:837'800 bytes
First seen:2020-06-10 09:57:25 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:kO0tcvDVeY7OGwGhrm/EJKiTn+Me9x5hSJKY+XmRtOjy:kOrvV7Op/Me9XGKnotT
TLSH 0F052303D8673F607A8681F1F975C0C0D1BE2F6D226FAD96BF793A09A31364A5C42749
Reporter abuse_ch
Tags:NanoCore nVpn RAT zip


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: mail.bremileintl.ga
Sending IP: 94.100.28.232
From: Wakker Trading <pramoni@bremileintl.ga>
Subject: Stock Availability
Attachment: 20200610dc.zip (contains "20200610dc.exe")

NanoCore RAT C2:
smith2020.ddns.net:1012

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.AIT.Trojan.Nymeria.1583.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.AitInject
Create hunting rule
Status:
Malicious
First seen:
2020-06-10 09:59:04 UTC
AV detection:
16 of 48 (33.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vk5q3vh6yqqkfnho6v3t2cmmvyyuk2h7wqb4xlkmaiunjrwnrvdq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip aabb0dd4fec420a2b4eef5773d098cae314568ffb403cbad4c0228d4c6cd8d47

(this sample)

NanoCore

Executable exe fab230794e95cf1e3f8b01e6f4d5c61547a53c20ebe04d761226a1d119d48b2f

  
Dropping
MD5 aeb3a06c21e39bbe3f408c5200b6c915
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 fab230794e95cf1e3f8b01e6f4d5c61547a53c20ebe04d761226a1d119d48b2f

Comments