MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07341ee8017c0caf0b19a1c280383bd4934b0998f83a97e23d6a85d7e628314b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07341ee8017c0caf0b19a1c280383bd4934b0998f83a97e23d6a85d7e628314b
SHA3-384 hash: 05e0d90055ad4e6f7eec33c5fdafb0a4f84363f52613cd4d1cc897f400bf22b5a63ab9e64f1cc75d0fb4b0c80adf5498
SHA1 hash: bb4647729763f772dfb99c036e4fc02aab85415b
MD5 hash: b6813018dcc827859d7b5dc0ea3ca199
humanhash: bulldog-chicken-zebra-pluto
File name:„Cargobus“ kurjerių tarnybos siuntos pranešimas.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:355'328 bytes
First seen:2020-06-22 07:52:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:abgZh9tx/MfTml2vtkc4ayaBPlQutpIU6STKHk:abMELwcEaDFlvtt6mK
Threatray 1'197 similar samples on MalwareBazaar
TLSH B274DF013FA8030EE66957BE1921525E13723BEA5661D6CC28BBFCCD5D25F43528C6B3
Reporter abuse_ch
Tags:exe LTU NanoCore RATgeo


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: vps.yidagnp.com
Sending IP: 45.95.169.73
From: „CARGOBUS“ KURINERŲ PASLAUGŲ SPAUSDINIMAS <info@yidagnp.com>
Subject: Re: „Cargobus“ kurjerių tarnybos siuntos pranešimas
Attachment: „Cargobus“ kurjerių tarnybos siuntos pranešimas.r11 (contains "„Cargobus“ kurjerių tarnybos siuntos pranešimas.exe")

NanoCore RAT C2:
185.244.29.128:9995

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/12481/
Detection(s):
SecuriteInfo.com.Artemis63715DF92E44.17574.UNOFFICIAL
Create hunting rule

Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/07341ee8017c0caf0b19a1c280383bd4934b0998f83a97e23d6a85d7e628314b/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-06-22 04:26:20 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=a42b52abpqgk6cyzuhbiaob32sjuwcmy7a5jpyr5nkc5pzrigffq._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
1fe9e9760604fed048445b3c79c91d30a9b1cf75a2a689c48181724a91df38e3
NanoCore
2eebb01bf1beb78cf343f5465a600eaf0c17af2bd28a7133d41581e8fa2ee5a4
NanoCore
41f79628a7ff72d611f593286f5b70a51c72f8359e6600535b1b3e9772fd7c0c
NanoCore
5c3e5f4453d50a5e13d0ac1c5faea25b77a20447b741fb0afad83b62985ac350
NanoCore
5e002e1e4c2038531e0a998fa380ba7816dcc2ae872f8d8142df0f11cc0330c3
NanoCore
6cb654eef04d1ee111df21c38103ff082fe9e035e46c036ebecc0bc21d3efd80
NanoCore
798676352c75523109a4cd08f282ae658bdde5ba1e77b45d19c8fee68115d3df
NanoCore
b8816e0b814bc0528b84fe7e0e89cf5e8168b64a8028d8610510a59f3f7c2268
NanoCore
bb398328320c76f194dc38b13275c4fe564cd0c85457fc83e62643110cfe0631
NanoCore
e8454346c57024c395766f6c82771a58c6f03cbaa15871646cc197aae5b73461
NanoCore
+ 1'187 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
evasion trojan keylogger stealer spyware family:nanocore
Link:
https://tria.ge/reports/200624-abbchy6b4n/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetThreadContext
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
185.244.29.128:9995
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

7d80e3d89349931a148b3b2f9da95b64

NanoCore

Executable exe 07341ee8017c0caf0b19a1c280383bd4934b0998f83a97e23d6a85d7e628314b

(this sample)

  
Dropped by
MD5 7d80e3d89349931a148b3b2f9da95b64
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/12481/

Comments