MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9f0de8108faa6826d3b2b64249174be641787c39f4be4696c7839797bdf4a77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9f0de8108faa6826d3b2b64249174be641787c39f4be4696c7839797bdf4a77
SHA3-384 hash: 58f2760000c11bfe7641fafb03a40a617b3b05405f6b08d0de21e2da9eeba763d056aec24cdf00ae3fe66c115cb9a34c
SHA1 hash: 7130b46f8111fa0c3dc098c7ac488134caa38fff
MD5 hash: b8eda002390c7bc8b14cef237cc2ed58
humanhash: mockingbird-iowa-jupiter-sodium
File name:proforma invoice 6017020.PDF.xz
Download: download sample
Signature NanoCore
Create hunting rule
File size:320'972 bytes
First seen:2020-06-18 06:19:02 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 6144:9mQbXQLRFh8XiM4/9iyMi9nDFZorAJ91ylHn9lOl5FuGEPlWs71Uf/Fw+eyk:9mXRr8SSyrDF51yBWl8l7yftw+ef
TLSH CC6423DBD263261CE6F0A47D2503F4CF7F013ADD4F2EF1A2D42F09581286A939A7645A
Reporter abuse_ch
Tags:NanoCore RAT xz


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: uclswift.com
Sending IP: 37.49.224.4
From: 김갑용부장 <gr_kim@uclswift.com>
Subject: RE: proforma invoice 0607020
Attachment: proforma invoice 6017020.PDF.xz (contains "proforma invoice 6017020.exe")

NanoCore RAT C2:
indomie.linkpc.net:1818

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.FakeAlert.9060.1798.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 06:20:07 UTC
AV detection:
13 of 48 (27.08%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5hyn5aii7ktie3j3fnscjeluxzsbpb6dt5f6i2lmpa4xs667jj3q._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip e9f0de8108faa6826d3b2b64249174be641787c39f4be4696c7839797bdf4a77

(this sample)

NanoCore

Executable exe 13b341d6fa28c47d0364bedb8ca0d1f11f02847075bb1fac9c4ec9ed9e90f610

  
Dropping
MD5 5e0bf478bbbe66d10d77730d4d40e958
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 13b341d6fa28c47d0364bedb8ca0d1f11f02847075bb1fac9c4ec9ed9e90f610

Comments