MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e496e2203246eeef6e239f758f8b7cb6ad795dcaef72aae3e068804fe07d1a90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e496e2203246eeef6e239f758f8b7cb6ad795dcaef72aae3e068804fe07d1a90
SHA3-384 hash: 25849d94acd814a6ba10505c9468d7b19d2c85ee67afa9471930b81687f1081c37838d94049cbc820bedcf4569b42116
SHA1 hash: 424bc5acd621bb2b36ab6c61cd0dc89f16d394e3
MD5 hash: 51de9470bac6969ecad600b5163bb7c6
humanhash: sierra-jersey-nebraska-friend
File name:PROOF OF PAYMENT.IMG
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'441'792 bytes
First seen:2021-03-10 08:27:00 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 12288:19kvpwGfQ4zjyRsis/tPFAfRJ72BOKq7/LFI8x+:1i7dzjyGD/RFAfbCEK+LFI8o
TLSH 1965F1A4FA66A271F45877B41673677C0A7E2D63E820EB6D3A0C32CE12353D148D3D5A
Reporter abuse_ch
Tags:img NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: imsantv23.netvigator.com
Sending IP: 210.87.247.11
From: noreply <loistang@biznetvigator.com>
Reply-To: noreply <bway2021@outlook.com>
Subject: Proof of payment
Attachment: PROOF OF PAYMENT.IMG (contains "PROOF OF PAYMENT.exe")

NanoCore RAT C2:
amechi.duckdns.org:4190 (23.105.131.156)

Intelligence

File Origin
# of uploads :
1
# of downloads :
170
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Gathering data
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2021-03-10 08:27:10 UTC
AV detection:
9 of 47 (19.15%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4sloeibsi3xo63rdt52y7c34w2wxsxok55zkvy7ancae7yd5dkia._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e496e2203246eeef6e239f758f8b7cb6ad795dcaef72aae3e068804fe07d1a90

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

img e496e2203246eeef6e239f758f8b7cb6ad795dcaef72aae3e068804fe07d1a90

(this sample)

NanoCore

Executable exe 06931cbd1dd5ccb784ad1dbaaf1c7fe4c32e470137101cc559925b4b1ffa0c26

  
Dropping
MD5 973a751f13f2286bcd400765bf51812d
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 06931cbd1dd5ccb784ad1dbaaf1c7fe4c32e470137101cc559925b4b1ffa0c26

Comments