MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2c0d0fb732a1676418336585176bb1e8e0f1db914b5419f398a172756f88be1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 4

Intelligence 4 IOCs YARA File information Comments

SHA256 hash:	b2c0d0fb732a1676418336585176bb1e8e0f1db914b5419f398a172756f88be1
SHA3-384 hash:	857e597e49f67cd07b43752ff22fa65ce19901c7ee93e8e3d7d1bfcd3b3f0a2db73f66ef21a28675129f48a7dc0c1a62
SHA1 hash:	d595eaa510ec0a60b6ed1d860e335ea5c2183c69
MD5 hash:	256b218fc7ff80bfaa55083504b525f3
humanhash:	hydrogen-cup-harry-five
File name:	Proof Of Payment.001
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	619'969 bytes
First seen:	2020-07-20 09:30:29 UTC
Last seen:	Never
File type:	rar
MIME type:	application/x-rar
ssdeep	12288:fnxgnAWF+bqOXg0finnw3XMxADPiLWoGjGUGyV35M:fKJ+bxX3cI8x4oy36
TLSH	87D42370BBB00F51B38E592C1DF51B353BA81F2325FA774DD68A27C48271869BE0C9A5
Reporter	abuse_ch
Tags:	001 NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: slot0.ndmpef.ml
Sending IP: 192.236.155.152
From: Paymentsemail@fnb.co.za<Paymentsemail@fnb.co.za>
Reply-To: <noreply@fnb.co.za>
Subject: Payment Notification
Attachment: Proof Of Payment.001 (contains "Proof Of Payment.scr")

NanoCore RAT C2:
harolds.ooguy.com:6051 (79.134.225.88)
harold.2waky.com:6051 (79.134.225.88)

Pointing to nVpn:

% Information related to '79.134.225.0 - 79.134.225.127'

% Abuse contact for '79.134.225.0 - 79.134.225.127' is 'abuse@privacyfirst.sh'

inetnum: 79.134.225.0 - 79.134.225.127
netname: PRIVACYFIRST-EU
country: EU
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
org: ORG-TPP6-RIPE
created: 2020-07-14T15:26:02Z
last-modified: 2020-07-14T15:31:06Z
source: RIPE