MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd978de889d1e904d215343c1bf49af8cdffb2a936d11575ef50e28a0b85eb34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


XpertRAT


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd978de889d1e904d215343c1bf49af8cdffb2a936d11575ef50e28a0b85eb34
SHA3-384 hash: 013f46138d1955799de5df50e22c8fde58032d70e0fd57caf5fd559dbda361759c1567de94125dd35cf286bb36e140d7
SHA1 hash: b96637071fd3eae1cf40cbec7d6282b21498b241
MD5 hash: 3b2ac65787ca7fe79f98d5e98061bdc0
humanhash: nevada-fanta-pennsylvania-massachusetts
File name:11_07_2020 PO_INVOICE 3309247.zip
Download: download sample
Signature XpertRAT
Create hunting rule
File size:305'000 bytes
First seen:2020-10-15 11:23:36 UTC
Last seen:2020-10-15 11:57:01 UTC
File type: zip
MIME type:application/zip
ssdeep 6144:maP9fGf35omSYunmy6HOC2cAPiL7yFH1dNReKVyf37G11IeToz:1P9fYJomS1my6HZ2VP4yHHeKV0GbVK
TLSH A054237C7A4834FFC26FE8212A69FC47AC5D500453B9D6EAD4AC8D5F2A904CE4D233A4
Reporter abuse_ch
Tags:NanoCore RAT XpertRAT zip


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: gmail.com
Sending IP: 156.96.47.42
From: ACCOUNT PROCUREMENT <mitul1.timurnetwork@gmail.com>
Subject: RE: 11_07_2020 PO_INVOICE #3309247 (REVISED)
Attachment: 11_07_2020 PO_INVOICE 3309247.zip (contains "11-10-2020 NEW SPECIF #3309 MCHN.exe")

NanoCore RAT C2:
sandshoe.myfirewall.org:5654 (156.96.47.42)

Intelligence

File Origin
# of uploads :
2
# of downloads :
99
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.004be7cd-6760703-0
Create hunting rule

Win.Trojan.Generic-6760707-0
Create hunting rule

Win.Trojan.Nanocore-5
Create hunting rule

Win.Packed.Generic-9777790-0
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd978de889d1e904d215343c1bf49af8cdffb2a936d11575ef50e28a0b85eb34/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 23:21:06 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3wly32ej2huqjuqvgq6bx5e27dg77mvjg3irk5ppkdriuc4f5m2a._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Nanocore
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dd978de889d1e904d215343c1bf49af8cdffb2a936d11575ef50e28a0b85eb34

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

XpertRAT

zip dd978de889d1e904d215343c1bf49af8cdffb2a936d11575ef50e28a0b85eb34

(this sample)

NanoCore

Executable exe a6477205ef1bd79cf5306cfa59940e34bf328ba2b447697d59d3936449f58ba5

  
Dropping
MD5 b0e73dcfba506ab521b23383e49e778c
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 a6477205ef1bd79cf5306cfa59940e34bf328ba2b447697d59d3936449f58ba5
  
Dropping
SHA256 8963180e8b2e7e51c5abd716e7a562ad010f663c41a38015ad2566231a7da9af
  
Dropping
MD5 ed21990ff9e29addfd9252f1ba0b30d4

Comments