MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f7cc72b1ea933e746798089350a35c1f109bf8d33f12dd94c402fee986cb3ac6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f7cc72b1ea933e746798089350a35c1f109bf8d33f12dd94c402fee986cb3ac6
SHA3-384 hash: b9348eae1f20c452013f1b99f35e989d5c01aa9dc7bee34b596979ff37ddbe0cbe6be956a014e964e62006d951485a94
SHA1 hash: 3523df3544d89ec0d5fae853cde6a09f96ff9b4d
MD5 hash: c9bce95c96d59c8fc993745ad085f24c
humanhash: snake-steak-shade-hydrogen
File name:PO_93029.zip
Download: download sample
Signature NanoCore
Create hunting rule
File size:796'146 bytes
First seen:2020-10-13 17:46:13 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 24576:Pss0iYxPCmj58THAszFovYK+4pSw/f4p0xQOZhb7WtoC:NSnjKTHAs2gKHkAf4kNZhPWr
TLSH BE0523CC3B50405153D83B92A2A3B7E9CBA65122DC78552D0E4B333A76B1629D3EEF17
Reporter abuse_ch
Tags:NanoCore Rackspace RAT zip


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: smtp77.iad3a.emailsrvr.com
Sending IP: 173.203.187.77
From: info@brightcenter.org
Subject: PurOrder
Attachment: PO_93029.zip (contains "PO_93029.exe")

NanoCore RAT C2:
zoomvision.xyz:4090 (193.142.59.106)

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.MulDrop14.2847.12002.3523.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f7cc72b1ea933e746798089350a35c1f109bf8d33f12dd94c402fee986cb3ac6/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2020-10-13 14:56:16 UTC
AV detection:
15 of 48 (31.25%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=67ghfmpksm7hiz4ybcjvbi24d4ijx6gth4jn3fgeal7otbwlhlda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f7cc72b1ea933e746798089350a35c1f109bf8d33f12dd94c402fee986cb3ac6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip f7cc72b1ea933e746798089350a35c1f109bf8d33f12dd94c402fee986cb3ac6

(this sample)

NanoCore

Executable exe ab43f4e6ffd099d03057feefa2e8371637e4dc1e7aed8486a4aa9f5f5e194ee4

  
Dropping
MD5 cfda115be2934c27e215001e62ca4ba0
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 ab43f4e6ffd099d03057feefa2e8371637e4dc1e7aed8486a4aa9f5f5e194ee4

Comments