MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2ad0aa1a038e5837fe7703d1455c2389617d19c591a4a99cbc0a766bb5207e7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2ad0aa1a038e5837fe7703d1455c2389617d19c591a4a99cbc0a766bb5207e7
SHA3-384 hash: 714c796b32c55acd96cb26a5f77394635ba37f433bc43aa8eb41585317599f03ad5b3e7fd5a363a5ce96139a779cdb35
SHA1 hash: 03bdc5e213445b589c0844fe14f6e3bdeb77c81c
MD5 hash: 4150c74f7af6c7e8d0744957393356e0
humanhash: edward-jupiter-helium-seventeen
File name:13- CIVCO.cab
Download: download sample
Signature NanoCore
Create hunting rule
File size:684'275 bytes
First seen:2020-08-31 11:26:53 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:Fe8o+ru+tidMurMbvfbePdMBxCZ+uvP8tNaEYwjpwR5mvyq2kSbKf4GY36Bd7HsC:Fe8bhWMuCbbbhu30New0EukSbK+ysDFU
TLSH C2E42343BC7B97DD80FB3245A1623C32796A428BBB5ADE52FA763054CD042158A5CBFC
Reporter abuse_ch
Tags:cab NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

From: Sara Suwan<no-reply@admin-owa.tk>
Subject: New order 31/2020
Attachment: 13- CIVCO.cab (contains "13- CIVCO.exe")

NanoCore RAT C2:
helixsohum-59977.portmap.io:59977 (193.161.193.99)

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2ad0aa1a038e5837fe7703d1455c2389617d19c591a4a99cbc0a766bb5207e7/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2020-08-31 05:02:40 UTC
AV detection:
1 of 48 (2.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=ykwqvinahdsyg77hoa6rivochclbpum4lenevgolyctwno2sa7tq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c2ad0aa1a038e5837fe7703d1455c2389617d19c591a4a99cbc0a766bb5207e7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar c2ad0aa1a038e5837fe7703d1455c2389617d19c591a4a99cbc0a766bb5207e7

(this sample)

NanoCore

Executable exe 8133b96955c936b094a7bfe2351554503c31ffd075767e0d5b735dd90a024dd4

  
Dropping
MD5 a5cf4dcadf3f133879b124d00fbf63e0
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 8133b96955c936b094a7bfe2351554503c31ffd075767e0d5b735dd90a024dd4

Comments