MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab7577e058fe383ca591a588edf1bc792623df1db761b15cca84743e0aa35d6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab7577e058fe383ca591a588edf1bc792623df1db761b15cca84743e0aa35d6f
SHA3-384 hash: 6975ffc76e8fd970575fa902aeb0a60fcb2255274aa50189aed4a9a39d20a534a0bd6c365a37398ea0219a0c772c71d9
SHA1 hash: f68e7b6b41d629bde4b7bbd57d61c90c891839ba
MD5 hash: fe65bf4b55931f2549169e453f104972
humanhash: venus-saturn-yankee-november
File name:PROOF OF PAYMENT.IMG
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'245'184 bytes
First seen:2020-12-03 08:48:43 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 6144:ywfMyOfR0X/aa63BQAyjJeRc5uddMfSmejmtfY3Fl8aqB3ByayYL411uUcM4lTwn:ywfMyOi/aqjJeDwSrjmxsDYvzDa15n
TLSH 9145F13132597599EABA0FB0546031840EB5B92B6668D7CCBC8E114E2BF7B01DF51EB3
Reporter abuse_ch
Tags:img NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: ns4.eoejhb.net
Sending IP: 41.76.108.28
From: godwin@neoshosecurity.co.za
Subject: PROOF OF PAYMENT
Attachment: PROOF OF PAYMENT.IMG (contains "PROOF OF PAYMENT.exe")

NanoCore RAT C2:
amechi.duckdns.org:3190 (79.134.225.69)

Pointing to nVpn:

% Information related to '79.134.225.0 - 79.134.225.127'

% Abuse contact for '79.134.225.0 - 79.134.225.127' is 'abuse@privacyfirst.sh'

inetnum: 79.134.225.0 - 79.134.225.127
netname: PRIVACYFIRST-EU
country: EU
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
org: ORG-TPP6-RIPE
created: 2020-07-14T15:26:02Z
last-modified: 2020-07-14T15:31:06Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
182
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.6091.14392.29813.UNOFFICIAL
Create hunting rule

Result
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab7577e058fe383ca591a588edf1bc792623df1db761b15cca84743e0aa35d6f/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vn2xpycy7y4dzjmruweo34n4petchxy5w5q3cxgkqr2d4cvdlvxq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.65
Link:
https://yomi.yoroi.company/submissions/ab7577e058fe383ca591a588edf1bc792623df1db761b15cca84743e0aa35d6f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

img ab7577e058fe383ca591a588edf1bc792623df1db761b15cca84743e0aa35d6f

(this sample)

NanoCore

Executable exe 703b8c64865eb7acfaa33024c2071e48ca581edf111d5ee79d66db1e2ed770b6

  
Dropping
MD5 c60a54238611fba25d0f62671fc6ff0d
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 703b8c64865eb7acfaa33024c2071e48ca581edf111d5ee79d66db1e2ed770b6

Comments