MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bcef0104776769d49c730e2670ee08a50eb65044bca0c5b8e7846eb1123d8850. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bcef0104776769d49c730e2670ee08a50eb65044bca0c5b8e7846eb1123d8850
SHA3-384 hash: 173ace2d774a1404044e580c4d51a635a7c2c0f2829548d30e50d478b29df4bce58950a2f0d25d969441624aa7fa0382
SHA1 hash: 0c0a36ef2da122efc070c0802b25e23a76a68730
MD5 hash: 133a392873d12c90c077613494adcd2a
humanhash: xray-white-sodium-football
File name:Paymentslip..7z
Download: download sample
Signature NanoCore
Create hunting rule
File size:841'669 bytes
First seen:2020-06-08 06:28:11 UTC
Last seen:Never
File type: 7z
MIME type:application/x-rar
ssdeep 24576:8nruK691BAjgHDjWAz2728ckWV1uDc5TqM5llm:CruKs1mjgjjWAR8cZu45Tv5llm
TLSH 5305232FDC5797CA211BCA63FD84DC342B6997C30E5A8B05A1B7A02AAD1754F773E402
Reporter abuse_ch
Tags:7z NanoCore nVpn RAT SCB


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: pmrelo.com
Sending IP: 103.240.91.86
From: Standard Chartered Bank <Account@transfopam.com>
Reply-To: sjrkintluea@gmail.com
Subject: Advice from Standard Chartered Bank
Attachment: Paymentslip..7z (contains "attachedfile..exe")

NanoCore RAT C2:
185.165.153.26:1985

Hosted on nVpn:

% Information related to '185.165.153.0 - 185.165.153.255'

% Abuse contact for '185.165.153.0 - 185.165.153.255' is 'abuse@privacy-matters.co'

inetnum: 185.165.153.0 - 185.165.153.255
netname: PRIVACY_MATTERS
remarks: This prefix belongs to a VPN service provider.
remarks: For us the privacy of our customers matters, which means we store no logs
remarks: related to any IP addresses.
remarks: Spamhaus, please note that blacklisting the clean prefixes of our hosting
remarks: partners and upstream providers is an act of coercion and will no longer
remarks: be tolerated.
remarks: Coercion is punishable by a custodial sentence or by a monetary penalty.
remarks: If you continue such practice we will not only take legal actions against
remarks: your organization, but also make such blackmailing attempts public in the
remarks: media.
country: AT
admin-c: PMVS3-RIPE
tech-c: PMVS3-RIPE
org: ORG-PMVS1-RIPE
status: ASSIGNED PA
mnt-by: PM-MNT
created: 2019-10-18T12:14:26Z
last-modified: 2019-10-18T13:31:16Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27121.RarHeur.NoDP.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-06-08 06:30:06 UTC
AV detection:
19 of 31 (61.29%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xtxqcbdxm5u5jhdtbythb3qiuuhlmucexsqmlohhqrxlcer5rbia._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

7z bcef0104776769d49c730e2670ee08a50eb65044bca0c5b8e7846eb1123d8850

(this sample)

NanoCore

Executable exe f8ff57b39131774171a58b4bc7784384a8823eeed42179505e9edfef7a002655

  
Dropping
MD5 16e0ddef3355a58eda41c3285d130759
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 f8ff57b39131774171a58b4bc7784384a8823eeed42179505e9edfef7a002655

Comments