MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e48235bac40b5a47060dd42fd838332cee8256f8abac3c0c9bf7436e4f201f34. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e48235bac40b5a47060dd42fd838332cee8256f8abac3c0c9bf7436e4f201f34
SHA3-384 hash: 392e9f127321229fd0c1490a5d53994cd0a1e0165f31f216140780af84820b10c28a5967557c64da8dd97dd215e1fc54
SHA1 hash: c0c9ccae9683e2b0e26bc2a5d375deffd015fb76
MD5 hash: d20ad1265290af58301f530a11ee689c
humanhash: eight-avocado-william-angel
File name:Request price listing.rar
Download: download sample
Signature NanoCore
Create hunting rule
File size:586'016 bytes
First seen:2020-10-21 07:04:32 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:dML4rvp4IyMUuE8GvtUGbN8zvp47DHjr6UzL/xI:tv7ZtE8G1UqN8zq7zjha
TLSH 10C4333AB1304ADB0B7BF18732E435576727508E2C91ABEFC6907CC266F86A2D6591D0
Reporter abuse_ch
Tags:NanoCore rar RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: vps.pantin-hoes.com
Sending IP: 45.95.169.163
From: Guadalupe <info@cintatex.es>
Subject: Product listing
Attachment: Request price listing.rar (contains "Request price listing.exe")

NanoCore RAT C2:
petroleum.sytes.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
96
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e48235bac40b5a47060dd42fd838332cee8256f8abac3c0c9bf7436e4f201f34/
Threat name:
ByteCode-MSIL.Trojan.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-20 15:44:34 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4sbdlowebnneobqn2qx5qobtftxievxyvowdyde365bw4tzad42a._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar e48235bac40b5a47060dd42fd838332cee8256f8abac3c0c9bf7436e4f201f34

(this sample)

NanoCore

Executable exe cf3dcb49ec0f07b8ddf68f9dedf71ca24cf7364c819082164df3a9ec0433e741

  
Dropping
MD5 e1435c2fb8252af2f505aad199fb6d16
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 cf3dcb49ec0f07b8ddf68f9dedf71ca24cf7364c819082164df3a9ec0433e741

Comments