MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ed829c14824482760ff5a49a575554311d85e09d741e060439879f7bfda39cee. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ed829c14824482760ff5a49a575554311d85e09d741e060439879f7bfda39cee
SHA3-384 hash: a95d28c96866a30f6e54a02977b1d50193f205be63d29d87adeef7fb1fb5120de5ff8186e45a093230498674e499c894
SHA1 hash: 67039e402883d8070ddc46b87fbef8a3b5c350d9
MD5 hash: cc09c1f99bacc564fb076c1eb59f1bea
humanhash: stream-oklahoma-mississippi-lamp
File name:BILLING INVOICE.pdf.uue
Download: download sample
Signature NanoCore
Create hunting rule
File size:353'098 bytes
First seen:2021-02-24 11:56:06 UTC
Last seen:Never
File type: uue
MIME type:application/x-rar
ssdeep 6144:ISE8IfVFmVLmspOpkA6BrGrwmSTWmkxDL0QKxXD5xhoP5enuq2Vv8ZoG02II2xcW:ISEBtFLspMwbTA21hoxenOM02IIP8Lf
TLSH FB742315E1AB53C36A245F0C82A9E747E0BB1B5633625BF699C6EDC0076ADCF4C28285
Reporter abuse_ch
Tags:Endurance NanoCore RAT uue


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: 192-254-204-11.unifiedlayer.com
Sending IP: 192.254.204.11
From: Accgt2 <mhdd_phoenix@yahoo.com>
Subject: Re: BILLING INVOICE:
Attachment: BILLING INVOICE.pdf.uue (contains "BILLING INVOICE.pdf.exe")

NanoCore RAT C2:
shahzad73.casacam.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
137
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ed829c14824482760ff5a49a575554311d85e09d741e060439879f7bfda39cee/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2021-02-24 11:56:13 UTC
AV detection:
19 of 47 (40.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5wbjyfecisbhmd7vusnfovkugeoylye5oqpambbzq6pxx7ndttxa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

uue ed829c14824482760ff5a49a575554311d85e09d741e060439879f7bfda39cee

(this sample)

NanoCore

Executable exe 4c2079f57e1ecb6dd303d37cbe6b7e84e44d987a3fc29ef1e351ebba9fd5cc35

  
Dropping
MD5 2374bb6b2675413f13a74466b9325b97
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4c2079f57e1ecb6dd303d37cbe6b7e84e44d987a3fc29ef1e351ebba9fd5cc35

Comments