MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0dac99fda4c85adb5638f6712984f21f93cc6047cebe42677c27d4ff74013bb1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 7

Intelligence 7 IOCs YARA 5 File information Comments

SHA256 hash:	0dac99fda4c85adb5638f6712984f21f93cc6047cebe42677c27d4ff74013bb1
SHA3-384 hash:	ce8302665d306ab093495c3b661fcb373f9f04148314f7a4eb991f0d58fe16b3945b87aa1b1dde968ee1228ee8e98ac4
SHA1 hash:	4a57bccf37f2f710ae384b93e229c87230aed56e
MD5 hash:	31166cef0ef1fc928b8adfe1f1099a1b
humanhash:	cola-oven-crazy-mobile
File name:	STMPO3683HK.exe.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	371'200 bytes
First seen:	2020-06-24 05:34:56 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:ezAkShd0seMXvmIpKLTPsp3E+ggVc+miF4iiBEI02nPaw40X2GDk8:ezAGMXeRTPs1m+PCRtCwcGg8
Threatray	1'599 similar samples on MalwareBazaar
TLSH	D684F10B37ACEA2BC27D09F994D13B8053B56AD67281F6D82CC069E968D3BE545313C7
Reporter	abuse_ch
Tags:	exe NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: cloud.spring.net.in
Sending IP: 103.127.29.248
From: Maria Sohail <acct1@vinflair.com>
Subject: Re: Inquiry(PO)
Attachment: STMPO3683HK.zip (contains "STMPO3683HK.exe.exe")

NanoCore RAT C2:
darlingtondc.hopto.org:1905 (185.165.153.17)

Pointing to nVpn:

% Information related to '185.165.153.0 - 185.165.153.255'

% Abuse contact for '185.165.153.0 - 185.165.153.255' is 'abuse@privacy-matters.co'

inetnum: 185.165.153.0 - 185.165.153.255
netname: PRIVACY_MATTERS
remarks: This prefix belongs to a VPN service provider.
remarks: For us the privacy of our customers matters, which means we store no logs
remarks: related to any IP addresses.
remarks: Spamhaus, please note that blacklisting the clean prefixes of our hosting
remarks: partners and upstream providers is an act of coercion and will no longer
remarks: be tolerated.
remarks: Coercion is punishable by a custodial sentence or by a monetary penalty.
remarks: If you continue such practice we will not only take legal actions against
remarks: your organization, but also make such blackmailing attempts public in the
remarks: media.
country: AT
admin-c: PMVS3-RIPE
tech-c: PMVS3-RIPE
org: ORG-PMVS1-RIPE
status: ASSIGNED PA
mnt-by: PM-MNT
created: 2019-10-18T12:14:26Z
last-modified: 2019-10-18T13:31:16Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

NanoCore

Link:

https://www.capesandbox.com/analysis/13402/

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Detection:

nanocore

Link:

https://mwdb.cert.pl/sample/0dac99fda4c85adb5638f6712984f21f93cc6047cebe42677c27d4ff74013bb1/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-06-24 05:36:06 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bwwjt7nezbnnwvry6zystbhsd6j4yychz27eez34e7kp65abhoyq._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

1cca3f293c7942a4e189397953842dc4510cb9a25019de5e22134a629ae09ce6

NanoCore

5cb62c0b64b7565e18107e60afd7c151938a27d8a183ec8cae4945bee2b00cf9

NanoCore

6367861a95be41d6a75f68ed68a361b88aa93cfce0069376d27a215650d4a4c7

NanoCore

8ce08c8d5299a9b14573f34240c4ca253ad1e96247cbb3ee1346d51f44f2b21c

NanoCore

8f88c71422c2790790dd50c3ff89fe3a5add4e1d55a83e50d6b445779d813796

NanoCore

c38c88878a7c284cd19149b2efb91129b16ae51c6ff32badb2622122185f1692

NanoCore

cd32596693b63c57661ffb8151cbf9be5507790cddbf5fe33a2dd538a6137775

NanoCore

f6418cb1cf7a9024b0a8e7f736c45f0a7e8aaa5ecd2d41241f20a56ea05ccf07

NanoCore

ff16fdbe3781373baa856a3858c83f8a6551f7dfe808265e9f9d876676c79212

NanoCore

+ 1'589 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

evasion trojan keylogger stealer spyware family:nanocore

Link:

https://tria.ge/reports/200624-l8wyenpl9x/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetThreadContext

Checks whether UAC is enabled

NanoCore

Malware Config

C2 Extraction:

darlingtondc.hopto.org:1905
185.165.153.17:1905

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/