MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5d024d2a5c44b0392090b5644787c5fa9ea3694852ee7fe6c8220130a74f6e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5d024d2a5c44b0392090b5644787c5fa9ea3694852ee7fe6c8220130a74f6e8
SHA3-384 hash: 4aa128ebfa52d33e5361491b96b8bf187b50d01ff7eae0e946f0865606e53fce55a189f8ebbc9acaacb64a37eda4e6e0
SHA1 hash: a8e528235e64d59e0ae92d94e3321cf60c584924
MD5 hash: 5e1eaf93f889bf5e27eb7fddc7cd5750
humanhash: ten-tango-georgia-rugby
File name:invoice.001
Download: download sample
Signature NanoCore
Create hunting rule
File size:517'198 bytes
First seen:2020-07-10 05:29:35 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:TGeLSM6We52WnT98yjQLxKkybLl0j39MWP0FfjwrsobiQxxTX+D:aeOMDe52WnTfkybZ61gfjosQx3+D
TLSH E9B42364195FEB0F5AE29C61DB34395C682288E59E2D13F9CB2651313FC0EE359C728B
Reporter abuse_ch
Tags:001 NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: slot0.ndmpef.gq
Sending IP: 104.168.149.160
From: Ms. Lilian Kate<liliank@adendorf.co.za>
Reply-To: <eurosales@yandex.ru>
Subject: FW:Invoice
Attachment: invoice.001 (contains "invoice.scr")

NanoCore RAT C2:
harolds.ooguy.com:6051 (79.134.225.88)

Pointing to nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
98
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5d024d2a5c44b0392090b5644787c5fa9ea3694852ee7fe6c8220130a74f6e8/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 20:14:00 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2xicjuvfyrfqheqjbnlei6d4l6u6unuuquxop7tmqiqbgctu63ua._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar d5d024d2a5c44b0392090b5644787c5fa9ea3694852ee7fe6c8220130a74f6e8

(this sample)

NanoCore

Executable exe 639b1e539bcaeaf95b0c6e64ca52831a4287ecd5748ff13824a60a8b25b26fbf

  
Dropping
MD5 0ca57894e3bafca99c457aaec5e23a72
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 639b1e539bcaeaf95b0c6e64ca52831a4287ecd5748ff13824a60a8b25b26fbf

Comments