MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1789493dcb90022e86b162654f82c15e83553689e0810c2758ed49ab1b8e5611. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 6


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1789493dcb90022e86b162654f82c15e83553689e0810c2758ed49ab1b8e5611
SHA3-384 hash: f15bc38250b0d71b8e78c23774d1bc37f28b6af77beeed0ce5cef629b1987c274abb35cccc9bc6ad7383d514dc09889a
SHA1 hash: f528d924be713c722457ac62468c41cb59f32122
MD5 hash: 3de5b2f1da9fc79e4f52aa55661b0ca3
humanhash: nitrogen-illinois-cat-maryland
File name:COVID 19 test kit.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:811'520 bytes
First seen:2020-05-04 13:18:42 UTC
Last seen:2020-05-04 13:18:47 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 226840561775b99befbf510bf424651d (8 x AgentTesla, 4 x Loki, 2 x NanoCore)
ssdeep 12288:oYIh/JDWJ31qKVD4sNe48ZoVX/tTIiPyN8/rvZVEbwFgOX4ePHztmOGvrZ/d:oF/Ds4LoVX1hagvZVxFgOjmOGvd/d
Threatray 2'750 similar samples on MalwareBazaar
TLSH 5505BFE6F1904C37C1B32A3D9C4B9764B92EFE512E2466863BF51D4C5F387A13A29087
Reporter jarumlus
Tags:NanoCore

Intelligence

File Origin
# of uploads :
2
# of downloads :
103
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.14.24062.21291.UNOFFICIAL
Create hunting rule

Win.Dropper.Remcos-7759529-0
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/357731
Behaviour
Behavior Graph:
n/a
Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-04 15:28:00 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
28 of 31 (90.32%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=c6euspolsabc5bvrmjsu7awbl2bvknuj4caqyj2y5ve2wg4okyiq._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
06cd18b13e77f513e826da358a65d6f61b05769ce830c8fb9d15b916c672ea61
NanoCore
8359e964cc6f542d0b069ece3e6529726d432b4946e054ac3b1c1bedcef2f7d8
NanoCore
aaa969de94835c4f59740b9bc3463693142db72d094969962d353c6466c10cd5
NanoCore
bc9deb7c274339a0a8b594def58348a995b3d7af4764c796c365b683b7400aea
NanoCore
bdddf5f5fa10f55e58819ff4ae4cf11902c3583503fa8fcf50ce67b1f1f66e4f
NanoCore
d53439692180d901981bcff18c2d0db8b349a8f4118c5682943c5dd22678af94
NanoCore
de5da27d55060988faa9fb717e8b32e374bca6d86f7eb758c3b1aa062c5aa90b
NanoCore
e41e433626e9dbf6c3a56c29c9dc60adfa53f71cd1c3bc10d682a1b2239c576d
NanoCore
f4dc1e741d3aef915ff984ff1346fc85ec3d37e9e89b275bb344e25c767751da
NanoCore
fc23f4b6273823d342d92e5fef7e4befc6ca4be41048054eb360ed0923db5983
NanoCore
+ 2'740 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger spyware stealer trojan upx
Link:
https://tria.ge/reports/201109-nnj865nak6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
UPX packed file
NanoCore
Malware Config
C2 Extraction:
185.244.30.139:4050
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments