MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf53044d31bd3c485ed63d56afaabeacc93ac355d30dccbfac3c2b61b7ae9c19. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf53044d31bd3c485ed63d56afaabeacc93ac355d30dccbfac3c2b61b7ae9c19
SHA3-384 hash: 1450cc06c2500b9730c709ec0dd42001c98784d55f60daa9a5b337695e4e2f34f167a7eff08754e0a0301160ddc68cdd
SHA1 hash: 430892b92f276ef77bd116804250a33be17b16c4
MD5 hash: cfd5da4da4d99cda251786045ccecee1
humanhash: crazy-white-six-fish
File name:IMO Advisory 2020.uue
Download: download sample
Signature NanoCore
Create hunting rule
File size:856'454 bytes
First seen:2020-07-13 11:25:10 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 24576:pbUGmJpl4wMKJYkTpld70wK+YwsLUJ7Z6MZCf6I1Pq:pbUGApOtKJYkbh0wAwpJIMcf6I1i
TLSH D705339570F55F10CED3A2BD06432928F6F271B89B90D9B2C0674F25D6C91C327A0ABE
Reporter abuse_ch
Tags:NanoCore nVpn RAT uue


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: hermancarlo.com
Sending IP: 162.210.98.146
From: ​International Maritime Organization(IMO) <E-Memo@imo.org>
Subject: Fwd: IMO Circulars
Attachment: IMO Advisory 2020.uue (contains "IMO Advisory 2020.pdf.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf53044d31bd3c485ed63d56afaabeacc93ac355d30dccbfac3c2b61b7ae9c19/
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-07-13 11:27:04 UTC
AV detection:
14 of 28 (50.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z5jqitjrxu6eqxwwhvlk7kv6vtetvq2v2mg4zp5mhqvwdn5otqmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

uue cf53044d31bd3c485ed63d56afaabeacc93ac355d30dccbfac3c2b61b7ae9c19

(this sample)

NanoCore

Executable exe 4cc5f468994fd62cc832482404cfc7e45232f059b9d355d3df41535a170b3470

  
Dropping
MD5 506e8290af1d7197477063d84ff144f1
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4cc5f468994fd62cc832482404cfc7e45232f059b9d355d3df41535a170b3470

Comments