MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbea50770dca0d364d24701e422e9f452cdfe1058e8af664bd25a4e491d4c419. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbea50770dca0d364d24701e422e9f452cdfe1058e8af664bd25a4e491d4c419
SHA3-384 hash: 6609a47b22670cbd9d59d15f989ce383c423e64ce9936359aba313f790e96f526f9b89f3a50a2a4eff6bc5bd2b146c15
SHA1 hash: 7e2b6eff9c83bee0f898fed3ae09b671bf0ea4ab
MD5 hash: 6d6cf3ccf592e019f0ba167c890a24bd
humanhash: skylark-pluto-maine-equal
File name:List of enquiry.img
Download: download sample
Signature NanoCore
Create hunting rule
File size:2'031'616 bytes
First seen:2020-05-11 14:26:36 UTC
Last seen:Never
File type: img
MIME type:application/x-iso9660-image
ssdeep 24576:Wtb20pkaCqT5TBWgNQ7a+S4KPCLUDG6OP5v46EzGLTXC+sqR6A:DVg5tQ7a+qPCLUD1OPGd6LTSO5
TLSH 6995E01273DE8361C7B25273BA65B701AEBF7C2506B1F86B2FD8093DE920161521E673
Reporter abuse_ch
Tags:img NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: ace.centraloeste.com
Sending IP: 181.30.25.138
From: Mary Campbell <laura.aveni@centraloeste.com.ar>
Subject: List of Enquiry
Attachment: List of enquiry.img (contains "List of enquiry.exe")

NanoCore RAT C2:
u852117.nvpn.so:5638 (185.140.53.142)

Pointing to nVpn:

% Information related to '185.140.53.0 - 185.140.53.255'

% Abuse contact for '185.140.53.0 - 185.140.53.255' is 'abuse@FOS-VPN.org'

inetnum: 185.140.53.0 - 185.140.53.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.140.53.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU
org: ORG-SL751-RIPE
admin-c: SL12644-RIPE
tech-c: SL12644-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2016-10-17T23:24:00Z
last-modified: 2020-04-06T18:59:49Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 14:37:21 UTC
AV detection:
20 of 48 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=7pvfa5ynzigtmtjeoapeelu7iuwn7yifr2fpmzf5ewsojeouyqmq._file
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

img fbea50770dca0d364d24701e422e9f452cdfe1058e8af664bd25a4e491d4c419

(this sample)

NanoCore

Executable exe c5fb8844494411c36592bfa4a33e2d47daa7d01f52a6e12632f7865eb3f49024

  
Dropping
MD5 65a0b315738fd8a5f7549cdbdea0e856
  
Dropping
NanoCore
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 c5fb8844494411c36592bfa4a33e2d47daa7d01f52a6e12632f7865eb3f49024

Comments