MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad8bcf1f196af3fea823417d3efaf6a67bc3d64aac59f4ee77c0a3f075013fd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad8bcf1f196af3fea823417d3efaf6a67bc3d64aac59f4ee77c0a3f075013fd5
SHA3-384 hash: 67d00cd67cdfa54160bd6d61dbaf3486953f5cd62a868335d8811fb6d9953de397259be802b0dac9e1a46885f264daee
SHA1 hash: df453fc294b93701c621e42baebe882077677af9
MD5 hash: 0079a435c3a23a37c6d80300e6638f28
humanhash: mexico-cat-snake-lion
File name:DES_ Holdings Ltd - products listing.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:665'657 bytes
First seen:2021-01-06 16:08:22 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:3sOyC2ONO3jgpjB12G+2y4Jdf6hfnQ69e2RH8jjSbH58L36vKC0ZZg:8XDnz4Mx4Jx6PQ6khW7KvQ
TLSH CEE423A96B71E4A724E73A78C1861BA50B50B0D53B91D782B71ED4181073A1FAFF12CF
Reporter abuse_ch
Tags:NanoCore rar RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: srv.kibriswebhizmetleri.com
Sending IP: 213.159.5.123
From: DESIGNATED HOLDINGS LTD <info@inndormcyprus.com>
Subject: Request for Quotation
Attachment: DES_ Holdings Ltd - products listing.rar (contains "DES_ Holdings Ltd - products listing.exe")

NanoCore RAT C2:
212.83.46.26:4021

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ad8bcf1f196af3fea823417d3efaf6a67bc3d64aac59f4ee77c0a3f075013fd5/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-01-06 16:09:06 UTC
AV detection:
13 of 46 (28.26%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vwf46hyznlz75kbdif6t56xwuz54hvskvrm7j3txycr7a5ibh7kq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ad8bcf1f196af3fea823417d3efaf6a67bc3d64aac59f4ee77c0a3f075013fd5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar ad8bcf1f196af3fea823417d3efaf6a67bc3d64aac59f4ee77c0a3f075013fd5

(this sample)

NanoCore

Executable exe 9fd3eec622da8536e22c164bbd05d80dada1003fadd07fd4800ced6c0579812c

  
Dropping
MD5 f88e81d7f208b4ebca34ae5f1f032d0f
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 9fd3eec622da8536e22c164bbd05d80dada1003fadd07fd4800ced6c0579812c

Comments