MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38bf20255640821b131eaa9c22c16a6e55e61e18a6cd4e248aa07b919847d626. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38bf20255640821b131eaa9c22c16a6e55e61e18a6cd4e248aa07b919847d626
SHA3-384 hash: 1709a1445e969d0e291f1ee6d2bd83ca6324f718d57571878c909ddadd71d9a3d0b0574615837edd096e88c464af01de
SHA1 hash: 56322d0751e48e4a8ee48dcd3c44a058d2f224cd
MD5 hash: def46fa8f7ed19921147161cb4d20164
humanhash: august-tennis-purple-violet
File name:Proof Of Payment.pdf.scr
Download: download sample
Signature NanoCore
Create hunting rule
File size:821'760 bytes
First seen:2020-07-08 08:49:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 927c37aff1985dca3a480112dcc5320c (11 x AgentTesla, 5 x NanoCore, 3 x Loki)
ssdeep 12288:iXjgbnMmIKCXsLIN4KKD6fpkR+ypsKtvP1QZTQC+ILopSxzbVGJjDFvTrXwT6hHE:Ikb4uLgpfpkZqENF/jh9mGu
Threatray 2'639 similar samples on MalwareBazaar
TLSH AC058D62F3A18872D123167C9C2BA6745437BE502975794A2BEB7C0C9F36382347BE47
Reporter abuse_ch
Tags:NanoCore nVpn RAT scr


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: slot0.ndmpef.cf
Sending IP: 192.236.163.68
From: sales@avautos.co.za<sales@avautos.co.za>
Reply-To: <sales@avautos.co.za>
Subject: FW: Proof of payment
Attachment: Proof Of Payment.pdf.xz (contains "Proof Of Payment.pdf.scr")

NanoCore RAT C2:
harolds.ooguy.com:6051 (79.134.225.88)
harold.jetos.com:6051 (79.134.225.88)

Pointing to nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/23007/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Launching a process
Creating a file in the %AppData% subdirectories
DNS request
Connection attempt to an infection source
Unauthorized injection to a system process
Enabling autorun with Startup directory
Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/38bf20255640821b131eaa9c22c16a6e55e61e18a6cd4e248aa07b919847d626/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-08 08:51:04 UTC
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hc7sajkwicbbwey6vkocfqlknzk6mhqyu3gu4jekub5zdgch2yta._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
2996f332b4d95897da808e8e53b372e1a3d7537d2a0a4adc5aa47f4333a29786
NanoCore
2acf6c2398a12dc97ff2ceec4f348ed6338c4aafb2dcfeb24856cf8526d12a9d
NanoCore
7404e34def5b0d893557483ab19926adc1635866bdfb0682adddc3caae877e03
NanoCore
9eb1cd61e77d7133bd5252c9c7574d4171ba60c856dbedd15754c5b0e3c827b4
NanoCore
b8a0c1d5363ff53775a0efa19229b82d0b4934232929aec50034a35a56f8d035
NanoCore
d2edc352a2a157c1ac51e314039ca894958635959d905900755992eed6a13256
NanoCore
d4d803a83e2c4c348972b6b8e5fce93416b0c60977a447818f592795505fdff1
NanoCore
db256170f60efdebefa6673fd5e985a7688c3ea5656aa827a61b9f3c600d0b00
NanoCore
f4dc1e741d3aef915ff984ff1346fc85ec3d37e9e89b275bb344e25c767751da
NanoCore
f5cffd780367ce051b550f171bdac33d5a4eba0b12acfac1bcfa63669c94104b
NanoCore
+ 2'629 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
keylogger trojan stealer spyware family:nanocore evasion
Link:
https://tria.ge/reports/200708-14qg41rzn6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Drops startup file
UPX packed file
NanoCore
Malware Config
C2 Extraction:
harolds.ooguy.com:6051
harold.jetos.com:6051
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

3e62365338dcce3fec4d1b7211917709

NanoCore

Executable exe 38bf20255640821b131eaa9c22c16a6e55e61e18a6cd4e248aa07b919847d626

(this sample)

  
Dropped by
MD5 3e62365338dcce3fec4d1b7211917709
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/23007/

Comments