MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6066b9b33c7336497e3fe0b7b0eb04c8fa8d27accdaad763658cd29865b2236e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 5

Intelligence 5 IOCs YARA 5 File information Comments

SHA256 hash:	6066b9b33c7336497e3fe0b7b0eb04c8fa8d27accdaad763658cd29865b2236e
SHA3-384 hash:	155695b44affb9fd04e449d544f15098145f76afba952e104cc71a2a4717fb104e0585a8f2a4c2d4928fe649b2a1207b
SHA1 hash:	b58ea1a17c927077d3782b746ba10bfdbb39ef42
MD5 hash:	6861c907930f6f4ab8cbc2b4898774bb
humanhash:	eighteen-maine-dakota-echo
File name:	bank detail.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	1'198'355 bytes
First seen:	2020-06-08 06:46:49 UTC
Last seen:	2020-06-10 11:51:25 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep	24576:bNA3R5drX9jdGjKF9Fv/nn4ruKxo/urD3EfIseYn8S9KRNOsmyK:G59JGjKlf4ruKxvEpe485KiK
Threatray	1'638 similar samples on MalwareBazaar
TLSH	80451242F6C704B1E8731D360A3EBA16A97E75210E29CB3E73D4492DE971553A331BA3
Reporter	abuse_ch
Tags:	exe HostGator NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: gateway12.unifiedlayer.com
Sending IP: 69.89.29.218
From: Jaco Lenten <jaco@straathof.nl>
Reply-To: Jaco Lenten <jaco@straath0f.nl>
Subject: Fw: INVOICE AND BANK DETAILS
Attachment: bank detail.z (contains "bank detail.exe")

NanoCore RAT C2:
innocentbooii.hopto.org:55420 (185.244.30.33)

Pointing to nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@FOS-VPN.org'

inetnum: 185.244.30.0 - 185.244.30.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.244.30.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU
org: ORG-SL751-RIPE
admin-c: SL12644-RIPE
tech-c: SL12644-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-06-03T09:20:12Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Wacatac

Status:

Malicious

First seen:

2020-06-08 06:48:07 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=mbtltmz4om3es7r74c33b2yezd5i2j5mzwvnoy3frtjjqznsenxa._file

Verdict:

malicious

Label(s):

nanocorerat

hawkeyekeylogger

emotet

NanoCore

404f05e16218e8fd6be8ddbe8b1e902bd523b21213928f2f595b29e0fce42a5a

NanoCore

4c4881464fd7d95cfe2d60dfd7beff8dd9c3426c15c945500db1e8714374556c

NanoCore

4cc5f468994fd62cc832482404cfc7e45232f059b9d355d3df41535a170b3470

NanoCore

602b19f259171ac577fb9d67952442c71809b4b3977484115883d7ed6be067a3

NanoCore

963ef1f1d728673b7769357ef250a53cf202abf7748fb780158e8b642aa63ba8

NanoCore

ae9576df43dd4f5e8d48c6774e7bbbd1a6baaad219c4022dd49af9fdaec57d61

NanoCore

b78996718e94fe9cf9cc228f474b774fd7bd54133762d183ba2e6c141b3a218a

NanoCore

e34ce3660cbabe945aadb571016cbd7e73ca4a7baa6e9cd64a3615b6474ccdc8

NanoCore

f9e386914a47b738dcfe89fadf3021be00c2dfe8824d8326ea79fcd79d3673cc

NanoCore

+ 1'628 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

family:nanocore evasion keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/201109-6w4c8y8w16/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Suspicious use of SetThreadContext

Adds Run key to start application

Loads dropped DLL

Reads user/profile data of web browsers

Uses the VBS compiler for execution

Disables Task Manager via registry modification

Executes dropped EXE

NanoCore

Malware Config

C2 Extraction:

innocentbooii.hopto.org:55420
185.244.30.33:55420

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/