MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6ce682a83c18ee831111df9d88287803e3f4566c542a69022b290b3853cc505. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6ce682a83c18ee831111df9d88287803e3f4566c542a69022b290b3853cc505
SHA3-384 hash: 37ee0a3bc1ce26ab3e157f159a3fc2fb57656d40727ea5be0d874eb0c71e7f416a19221ee9e8114ccac8c8051d40821e
SHA1 hash: f62afaa3d43186728bc01c1c6d36bc88e1e3a017
MD5 hash: b43765f91def4fbc03643f752c56e40e
humanhash: low-network-moon-skylark
File name:JMG Memo-Circular No 018-21.PDF.uue
Download: download sample
Signature NanoCore
Create hunting rule
File size:447'354 bytes
First seen:2021-02-23 07:26:22 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 12288:JvrnngdIaVIFL1VC+gNgk1Fq+Pihy6qkmpG:Jvrngua6FLXC9q1wpbpG
TLSH 949423AE1C761E4E092AFCE16A7CECC73FE76674D8D946D3444CEE91E246A001DF1684
Reporter abuse_ch
Tags:NanoCore RAT uue


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: sd.latticesystems.com
Sending IP: 204.152.206.90
From: PJMCC Secretariat <secretariat1@immajpjmcc.org>
Subject: JMG Memo-Circular No 018-21 MPA Port Marine Circular No 07 of 2021
Attachment: JMG Memo-Circular No 018-21.PDF.uue (contains "JMG Memo-Circular No 018-21.PDF.exe")

NanoCore RAT C2:
shahzad73.casacam.net:9036

Intelligence

File Origin
# of uploads :
1
# of downloads :
124
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6ce682a83c18ee831111df9d88287803e3f4566c542a69022b290b3853cc505/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-23 07:26:26 UTC
AV detection:
10 of 47 (21.28%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=23hgqkudyghoqmirdx45rauhqa7d6rlgyvbknebcwkilhbj4yucq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d6ce682a83c18ee831111df9d88287803e3f4566c542a69022b290b3853cc505

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

uue d6ce682a83c18ee831111df9d88287803e3f4566c542a69022b290b3853cc505

(this sample)

NanoCore

Executable exe 019dce879f64d1a5a23de8ae1d0eac08200954b26665232507187e7f524b4f24

  
Dropping
MD5 f12d78ae2ce77b187e98b382bc400e6e
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 019dce879f64d1a5a23de8ae1d0eac08200954b26665232507187e7f524b4f24

Comments