MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48b89c60002dab9e048b13d51a6099cadd999627ffacc849d660f7e73e6d9b0d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 3

Intelligence 3 IOCs YARA 5 File information Comments

SHA256 hash:	48b89c60002dab9e048b13d51a6099cadd999627ffacc849d660f7e73e6d9b0d
SHA3-384 hash:	92ee73959f4a7aa969d97e9dd12708503e804bb0929b3e4b8efd0df4a5b75fba4e1fe52cf7f3c6c4dad7885730fb1f46
SHA1 hash:	e37ccf3f2301db74c4f445eb072486e4d891d2d6
MD5 hash:	4e58bc8ff019d313ca5c66052a6f722b
humanhash:	berlin-hydrogen-coffee-india
File name:	0RDER.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	422'912 bytes
First seen:	2020-05-19 08:29:48 UTC
Last seen:	2020-05-19 09:45:26 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:wzG38C+QsXJJuYzv7KYRYZjWf6SW+s3zzVb1L1OHQy3R05jvPmNx+:wzlC+BXJs2vxj6NnVJAwSR05TPU
Threatray	143 similar samples on MalwareBazaar
TLSH	A794ADE41398D623D6ED53B99CA9088D63E483F66D4FFF86685175FA294F382A40304F
Reporter	abuse_ch
Tags:	exe NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: smtp80.iad3a.emailsrvr.com
Sending IP: 173.203.187.80
From: sarah.cole@learnershr.com <sarah.cole@learnershr.com>
Reply-To: one@click.com
Subject: ATTACHED IS OUR 0RDER FOR THE MONTH CHECK AND REVERT ASAP
Attachment: 0RDER.rar (contains "0RDER.exe")

NanoCore RAT C2:
79.134.225.6:50105

Hosted on nVpn:

% Information related to '79.134.225.0 - 79.134.225.63'

% Abuse contact for '79.134.225.0 - 79.134.225.63' is 'abuse@anmaxx.net'

inetnum: 79.134.225.0 - 79.134.225.63
netname: BASEL-HOSTING-225-0
country: CH
admin-c: AM38880-RIPE
tech-c: AM38880-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
created: 2016-04-17T00:42:52Z
last-modified: 2016-04-18T06:23:19Z
source: RIPE
remarks: abuse-c AIS166-RIPE
org: ORG-AGIS12-RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.MSIL.GenKryptik.EIAJ.29196.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Genkryptik

Status:

Malicious

First seen:

2020-05-19 08:35:54 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

24 of 48 (50.00%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jc4jyyaafwvz4belcpkruyezzloztfrh76wmqsowmd36optntmgq._file

Verdict:

unknown

Result

Malware family:

n/a

Score:

6/10

Tags:

persistence

Link:

https://tria.ge/reports/201109-4kfxvtj14s/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Adds Run key to start application

Maps connected drives based on registry

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/