MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3a8126739fd0316ecf333a023a4d7c24524a001c67174db8cec96a71dbf7aff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3a8126739fd0316ecf333a023a4d7c24524a001c67174db8cec96a71dbf7aff
SHA3-384 hash: c50bc30d810e9e78c85d3e61fedab5d930b5e7fcf73bf61fc72571b7ee0ae805287ef303dd724d380c6c5327ead8057d
SHA1 hash: 5287a8a4e2ebdafc87e128b5234059b3b79dfd19
MD5 hash: 19fc3c7c559e5d9684d16d17da1de093
humanhash: three-california-table-lamp
File name:receipt.img
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'245'184 bytes
First seen:2021-02-24 06:32:01 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:tncU0euEk1BdSfVfDpr26vgOIWO2UUA+4ZPZ4x07dtSvz:tGdkV2V0cSxOdtSL
TLSH 7A45CF99F33468EEE417C07E9979DC341533BD6A962B450E310F312C4A6B3C386A6E97
Reporter abuse_ch
Tags:img NanoCore RAT USPS


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: dedi-3722026.furtadoleite.com.br
Sending IP: 162.214.65.19
From: USPS_COM <support@wakefoodsbr.com>
Subject: Your Parcel
Attachment: receipt.img (contains "receipt.exe")

NanoCore RAT C2:
helpout.duckdns.org

Intelligence

File Origin
# of uploads :
1
# of downloads :
113
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Foxhole.Iso_fs1929.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d3a8126739fd0316ecf333a023a4d7c24524a001c67174db8cec96a71dbf7aff/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 06:32:14 UTC
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2oubezzz7ubrn3htgoqchjgxyjcsjiabyzyxjw4m5slkohn7pl7q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

img d3a8126739fd0316ecf333a023a4d7c24524a001c67174db8cec96a71dbf7aff

(this sample)

NanoCore

Executable exe 962debf4655a7917256ad3234217b1927a2c88afd4631ed8258121c5b9e2dfee

  
Dropping
MD5 a4a4bc6e3283ecc66cd4a4dc864acd9a
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 962debf4655a7917256ad3234217b1927a2c88afd4631ed8258121c5b9e2dfee

Comments