MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4bc614ab18659a693f6e2f90412d328b1bdeb6249763f1df5b5f154ccc86a26d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4bc614ab18659a693f6e2f90412d328b1bdeb6249763f1df5b5f154ccc86a26d
SHA3-384 hash: 8c5e7e21dacd9e2dbb7fa0febbb5e5199a440b7c813c73ebe3b2191f622c05771aeba7c814510a5cc94d033da41be842
SHA1 hash: 72b1012af049f1c541252ce0426d082dd1dc95d6
MD5 hash: 0ebb669b2112842ff7ad358ac4c17f7b
humanhash: romeo-eight-mississippi-table
File name:Shipping Documents.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:693'760 bytes
First seen:2020-05-11 10:48:33 UTC
Last seen:2020-05-11 12:05:43 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 493c598232e367721346942066fd842d (4 x AgentTesla, 1 x FormBook, 1 x NanoCore)
ssdeep 12288:nTxdJyB/4pbqcZixgyhMsSPYvw3riK73YU+29SElKAE:TnJs4BqcZxyyrY43l73YT29tlo
Threatray 3'301 similar samples on MalwareBazaar
TLSH C3E4AE22E2E058F3F0631A3D5D1B5F6898EEBD513D285E466BF51C4CAF38391342A297
Reporter jarumlus
Tags:NanoCore

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-11 09:46:00 UTC
File Type:
PE (Exe)
Extracted files:
294
AV detection:
28 of 31 (90.32%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jpdbjkyymwngsp3of6iecljsrmn55nres5r7dx23l4kuztegujwq._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
09b0e2a84a8e7165c5a3b23efcd53cde0a7090e1ebe09a86cca86c33f7c39290
NanoCore
45a0e874237e2b2ae5828e37fcf1600f44e35b5f90ebae5e56b42289bf9ce8b4
NanoCore
5ade9d2627b6dc5d38a850e6a49f6557a9d9c63d16fe0199496a5559a74e7956
NanoCore
5e4da067908b56292fc2595a72378a091feccd8090b6ba186db4287c94a68680
NanoCore
6a5bf81d82a8112290a0eef40ece993c13143ad63feb1b4452528187a98627b0
NanoCore
6e417fffcd28aea1071fa5c5b240b2f2e655efd6a153040c3fb64876736dcaa5
NanoCore
8359e964cc6f542d0b069ece3e6529726d432b4946e054ac3b1c1bedcef2f7d8
NanoCore
aaa969de94835c4f59740b9bc3463693142db72d094969962d353c6466c10cd5
NanoCore
b2446dade622509df2cd602bad484ae10a3e615f0766ac662ec87c9d68a4b21b
NanoCore
cc829675a0e11138d47b42b5c19e45403d7d73731aac0c97ca8b2a0e37a960f8
NanoCore
+ 3'291 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger spyware stealer trojan upx
Link:
https://tria.ge/reports/201109-pcj9fbn4vs/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
UPX packed file
NanoCore
Malware Config
C2 Extraction:
:4050
185.244.29.216:4050
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar aaf786036726f618a12b6908c182f5b7eaf1d3d956b1505803cab492476970a7

NanoCore

Executable exe 4bc614ab18659a693f6e2f90412d328b1bdeb6249763f1df5b5f154ccc86a26d

(this sample)

  
Dropped by
MD5 a848dc6eeb688015edaa5a8437bd6f81
  
Dropped by
SHA256 aaf786036726f618a12b6908c182f5b7eaf1d3d956b1505803cab492476970a7
  
Delivery method
Distributed via e-mail attachment

Comments