NanoCore_RAT_IOCs_15-04-2019

#Autoit #Nanocore #RAT #Dropbox
---------------------------------------
15-04-2019 					IOC's
---------------------------------------
Main object- "SCAN_20190415_SLIP.pdf.gz"
	url	https://www.dropbox.com/s/l6w48gwloftkcks/SCAN_20190415_SLIP.pdf.gz?dl=1
	sha256	7db8758e383d22c29613c568c9915df897c7124e46b963b116daacd4ee0dfe27
	sha1	f74a26e761e998aa01f0a9be5453120e1a7bf815
	md5	ca1dd7fd7955104f061360f4e014752e
Dropped executable file
	sha256	C:\Users\admin\Desktop\SCAN_20190415_SLIP.exe	2b828b77fa9df168c705b08a9c111a5d5266638d564f9e270df004d0cdbc0416
	sha256	C:\Users\admin\AppData\Local\Temp\64982355\efg.exe	237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
DNS requests
	domain	zenrnarketinghyd.duckdns.org
Connections
	ip	95.213.251.165