MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d89a9e975c2d0e125cb3251b589c00b1a35fde0e99d7074dd6f5b0ed93b66635. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d89a9e975c2d0e125cb3251b589c00b1a35fde0e99d7074dd6f5b0ed93b66635
SHA3-384 hash: 9f50909e9ca4a7243b1abf052669ea2c711b0f714926275cca4278fe197a65b5c390f019e7a3ae0bbe5686211e8aabe1
SHA1 hash: a14a60fbc383d9c3533496f8517e35b1f8d7ab8b
MD5 hash: d6e1c31c6109807a74734931d537ef40
humanhash: chicken-one-cola-arizona
File name:POBGR5-98247.cab
Download: download sample
Signature NanoCore
Create hunting rule
File size:315'936 bytes
First seen:2021-01-08 08:22:45 UTC
Last seen:Never
File type: cab
MIME type:application/vnd.ms-cab-compressed
ssdeep 6144:wui2/0JCwjOqB7h6aFEYQj9nWWMr4u0MYlcf2EpdYyfJw8F2r2QQvkpF:wuf/0JCwj9TnUWWM/qcfNpyb2OF
TLSH 1564230A5AAC60D738763AE7147C1B7CED061BFCE8A199107BF8854681FE933C8A5573
Reporter abuse_ch
Tags:cab NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: mail-smail-vm20.hanmail.net
Sending IP: 203.133.180.201
From: Mr Hong <lub43@hanmail.net>
Subject: Request for Quotation for PO#BGR5-98247
Attachment: POBGR5-98247.cab (contains "BFSV-1F(N)_1B-8B_ANSI.exe")

NanoCore RAT C2:
45.138.49.96:9999

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BehavesLike.Win32.Generic.fc.15060.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Artemis0CDEF98F5ED0.11763.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d89a9e975c2d0e125cb3251b589c00b1a35fde0e99d7074dd6f5b0ed93b66635/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2021-01-08 08:23:13 UTC
AV detection:
9 of 46 (19.57%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3cnj5f24fuhbexfteunvrhaawgrv7xqothlqotow6wyo3e5wmy2q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Nanocore
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d89a9e975c2d0e125cb3251b589c00b1a35fde0e99d7074dd6f5b0ed93b66635

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

cab d89a9e975c2d0e125cb3251b589c00b1a35fde0e99d7074dd6f5b0ed93b66635

(this sample)

NanoCore

Executable exe 41617ac4431c229ba27bf94617b465309e7f502ae5088cd12ee571a0428ea120

  
Dropping
MD5 36f13aad903e851544fe137feca3435b
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 41617ac4431c229ba27bf94617b465309e7f502ae5088cd12ee571a0428ea120

Comments