MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d266dfa276da371f6ec858eb1efbcc8c0c0fd4df50fedcf0a4df7165857f727. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 5

Intelligence 5 IOCs YARA 5 File information Comments

SHA256 hash:	3d266dfa276da371f6ec858eb1efbcc8c0c0fd4df50fedcf0a4df7165857f727
SHA3-384 hash:	94ba6ea574f2395379c73b3599c0901c46567aa8f821b6f04bdadf75209a1009b554a05946f0e60c20dcf9e8252d0356
SHA1 hash:	8585859ff0a772260caf6aa7ba22a0b9005982c2
MD5 hash:	39af3277d501e79c96d53255f6da59ba
humanhash:	berlin-eight-item-lima
File name:	PagoRecibo20200506753545746654.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	1'612'288 bytes
First seen:	2020-05-06 18:10:46 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep	49152:CVg5tQ7aZy2okreRGoVSmqE6Pt5EkysyDmZ/5:sg5672QooVMEQfDyiZ
Threatray	1'902 similar samples on MalwareBazaar
TLSH	C275E12373DE8361C7B26273BA15B7017EBF782506A1F96B2FD4093DE920122525E673
Reporter	abuse_ch
Tags:	CaixaBank exe NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: vps.applarum.com
Sending IP: 45.95.168.149
From: Banco Caixa <caixabank.servicio@accountant.com>
Subject: Pago Recibo
Attachment: PagoRecibo20200506753545746654.r11 (contains "PagoRecibo20200506753545746654.exe")

NanoCore RAT C2:
hungerfighter.ooguy.com:8070 (185.165.153.203)

Pointing to nVpn:

% Information related to '185.165.153.0 - 185.165.153.255'

% Abuse contact for '185.165.153.0 - 185.165.153.255' is 'abuse@privacy-matters.co'

inetnum: 185.165.153.0 - 185.165.153.255
netname: PRIVACY_MATTERS
remarks: This prefix belongs to a VPN service provider.
remarks: For us the privacy of our customers matters, which means we store no logs
remarks: related to any IP addresses.
remarks: Spamhaus, please note that blacklisting the clean prefixes of our hosting
remarks: partners and upstream providers is an act of coercion and will no longer
remarks: be tolerated.
remarks: Coercion is punishable by a custodial sentence or by a monetary penalty.
remarks: If you continue such practice we will not only take legal actions against
remarks: your organization, but also make such blackmailing attempts public in the
remarks: media.
country: AT
admin-c: PMVS3-RIPE
tech-c: PMVS3-RIPE
org: ORG-PMVS1-RIPE
status: ASSIGNED PA
mnt-by: PM-MNT
created: 2019-10-18T12:14:26Z
last-modified: 2019-10-18T13:31:16Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.27686.AidExe.UNOFFICIAL

Sanesecurity.Malware.27684.AidExe.UNOFFICIAL

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Injector

Status:

Malicious

First seen:

2020-05-06 14:08:02 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

26 of 31 (83.87%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hutg36rhnwrxd5xmqwhld354zdamb7kn6uh63tykjx3rmwcx64tq._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

4d42868a3dbc835f6c25856f51ca721a2e7eac4c9a775c67029b831ffed156cc

NanoCore

6266401f72539a6707cd55f3e277f6f878e8826af0f2944f7538319c08adc9e7

NanoCore

790ddf3ff510253b5db189de93fb5e43fadc838d1c254d1d7f5236473e43526a

NanoCore

89f5773de397e09275d7d02812ec937343e878030232964061bb6aafdea5ccde

NanoCore

ba16a65c18b43738c394c42b43160d34f233feae20d45209c6f759c14482b58b

NanoCore

c7d61fee58d6bb0e581f517fff6ab3c3738fbb12a261e3ce10c525d18fc1c1a9

NanoCore

da26ba1e13ce4702bd5154789ce1a699ba206c12021d9823380febd795f5b002

NanoCore

e9fc4844ee50f9e59616bd7238bfae3de6b8b194abf635e787e5a44d8658fe42

NanoCore

fa02a7e8922b8a0a152ff8ced55d3b005e6eac67af9d9eff7ec03192b6d1aee3

NanoCore

+ 1'892 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

family:nanocore keylogger spyware stealer trojan

Link:

https://tria.ge/reports/201109-pnc6fwmzd2/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Drops startup file

NanoCore

Malware Config

C2 Extraction:

hungerfighter.ooguy.com:8070
127.0.0.1:8070

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/