MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fff41d3fd8f81b5be9332b2c2268eeee20b99eeea1c69f093c69c6ba2939acde. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence 1 File information 4 Yara Comments

SHA256 hash: fff41d3fd8f81b5be9332b2c2268eeee20b99eeea1c69f093c69c6ba2939acde
SHA1 hash: 35923806598f06b9b61df55411536d60780de35a
MD5 hash: 9e3e35d26976c238aa1d96d28f895ad5
File name:Purchase Order No-PO00000261.rar
Download: download sample
Signature NanoCore
File size:15'772 bytes
First seen:2020-05-22 15:00:23 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 384:ya/ZePP3THtvuFaYjv4/ohzA3oUIqoIF8HMx8/9It:yac3THRs0kNUIqoNMx8/+
TLSH 9362C0E3D82EFB60F75E5ABC08C91C44044D26F1F2A9EC8DAA3641653DD691D07DE0E5
Reporter @abuse_ch
Tags:NanoCore nVpn rar RAT

Malspam distributing NanoCore:

Sending IP:
From: Panagiotis Vlaxos <>
Subject: Purchase Order #No .: PO00000261
Attachment: Purchase Order No-PO00000261.rar (contains "Purchase Order #No-PO00000261.exe")

NanoCore RAT C2: (


Mail intelligence
Trap location Impact
Global Low
# of uploads 1
# of downloads 23
Origin country FR FR
ClamAV No detection
VirusTotal:Virustotal results 13.56%

File information

The table below shows additional information about this malware sample such as delivery method and external references.



rar fff41d3fd8f81b5be9332b2c2268eeee20b99eeea1c69f093c69c6ba2939acde

(this sample)

Delivery method
Distributed via e-mail attachment