MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf776e68a339c68ea8b72e9f04eb9c015871707f1bd33208cad4914ae8001433. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf776e68a339c68ea8b72e9f04eb9c015871707f1bd33208cad4914ae8001433
SHA3-384 hash: 920474d8455f00b79092ccf3d56f4413249432c90a8c7e1fd10f6c4c0edcf339229516999caade5d52d47eff1de2f7e6
SHA1 hash: d33f247468caa937812d08000708b931d268c4d2
MD5 hash: 9b65c3466f5c53085c0f5379470b1555
humanhash: juliet-tennis-steak-artist
File name:order-181289654312464648.iso
Download: download sample
Signature NanoCore
Create hunting rule
File size:5'877'760 bytes
First seen:2021-01-13 09:12:43 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 98304:6QRUDjYYo/PJhTLqj7tLS+5xZEU2ytc40Gk15GhYwfxK+gEwj7u/B:6QRUIzTLq75x+U/tc9GrhPAFOJ
TLSH A24612C697908A97E01030B7559DEBA52362ECFB6A03C7947B08FDBD6D333D2184E295
Reporter abuse_ch
Tags:iso NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: 191-101-130-44-hostedby.bcr.host
Sending IP: 191.101.130.44
From: Ronald Rina <rrina@smediasys.com>
Reply-To: rrina-smediasys@post.com
Subject: Request For QUOTE (INNOVATION PROJECT)
Attachment: order-181289654312464648.iso (contains "order-181289654312464648.exe")

NanoCore RAT C2:
nanopc.linkpc.net:40700 (185.157.161.86)

Intelligence

File Origin
# of uploads :
1
# of downloads :
190
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf776e68a339c68ea8b72e9f04eb9c015871707f1bd33208cad4914ae8001433/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-13 09:13:06 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=z53w42fdhhdi5kfxf2pqj244afmhc4d7dpjtecgk2siuv2aacqzq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/cf776e68a339c68ea8b72e9f04eb9c015871707f1bd33208cad4914ae8001433

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

iso cf776e68a339c68ea8b72e9f04eb9c015871707f1bd33208cad4914ae8001433

(this sample)

NanoCore

Executable exe 2d564ae361eb499ca493273e9fcfb88546105c88293c7633a7e1580a435cee9f

  
Dropping
MD5 28da42c2cd57e51cb8ea7df263802924
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 2d564ae361eb499ca493273e9fcfb88546105c88293c7633a7e1580a435cee9f

Comments