MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 52a0b32117ded008aba2f96eae8dcd1e49600fa1666ad517d03b81d71f62f8ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 6


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 52a0b32117ded008aba2f96eae8dcd1e49600fa1666ad517d03b81d71f62f8ac
SHA3-384 hash: 79c181bd8db3ea29ca50c26a734c03d080ab31047f95e9977de1c63252858578f981b6d9a8778787d277a87d705bfc1b
SHA1 hash: f367557c654a95e2507e911edfe363fc1f98a9d3
MD5 hash: 8ee4c00412530a8ca0e884f5dfcdea55
humanhash: kilo-jupiter-floor-mountain
File name:52a0b32117ded008aba2f96eae8dcd1e49600fa1666ad517d03b81d71f62f8ac
Download: download sample
Signature NanoCore
Create hunting rule
File size:442'368 bytes
First seen:2020-06-29 07:25:46 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:ur2AQXrsYlUCE2f1BPUGRQG044rLV6Btpmkrq1bG:ur2A+sY+YEr3ApfS
Threatray 1'917 similar samples on MalwareBazaar
TLSH 9994F1563BEA8A6FE29E867D716201038379C2D398C3F3EF19D464B28B627E105531D7
Reporter JAMESWT_WT
Tags:NanoCore

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/15611/
Detection(s):
Win.Trojan.Nanocore-5
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/52a0b32117ded008aba2f96eae8dcd1e49600fa1666ad517d03b81d71f62f8ac/
Threat name:
ByteCode-MSIL.Hacktool.Generic
Create hunting rule
Status:
Malicious
First seen:
2019-02-18 19:19:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
28 of 31 (90.32%)
Threat level:
  1/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kkqlgiix33iark5c7fxk5dondzewad5bmzvnkf6qhoa5oh3c7cwa._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
0a61e8b840644e0fb6739996a0d65da3b8b7f40478e96afbc889d9c7bf65a73f
NanoCore
0b227a11aa15b176c7d63d4aacbfcf8cd70bfa8f457d4d762053c559cd31435a
NanoCore
39dc3a88f6948d7740c6260cdabb5affccf9bcf4da744c4cc44cf674950c7c49
NanoCore
408b676c05cde3623e9271d39c20ec19aaa9ad9882db0f08451442379409be99
NanoCore
488980785e66e103f4754876bff263b6b043c2e085091e72f9ed50dd94ece3a1
NanoCore
49921e6531eac85bf200970640a074072f6071b7a18d23af56706788cd421c1c
NanoCore
525ad168dd1152a5dd477791b01b3d6edf0ddf296b72ef04b96a79f1e2a1e499
NanoCore
8be48a6508ced97bdd4d41459ef5e858b505b150fd3ea2d00229e6a72bb9a36b
NanoCore
b87ec3d4ae4232b0e9a0e6f42f32717242f8eabaed85c2d380737a3fa17bbf4e
NanoCore
d28b1aecf31d66ac879101538af986bd720ac417046bca393e75985bea7edecf
NanoCore
+ 1'907 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
evasion trojan keylogger stealer spyware family:nanocore persistence
Link:
https://tria.ge/reports/200629-2mfq9cnq4e/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: GetForegroundWindowSpam
Creates scheduled task(s)
Drops file in Program Files directory
Adds Run entry to start application
Checks whether UAC is enabled
Loads dropped DLL
Executes dropped EXE
NanoCore
Malware Config
C2 Extraction:
nemesis423.ddns.net:54984
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/15611/

Comments