MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64bdaa17011415cb9a460a276b7cdc5824d69cb279d14691f313a71c24abbfd7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64bdaa17011415cb9a460a276b7cdc5824d69cb279d14691f313a71c24abbfd7
SHA3-384 hash: 8c4227a86a97f274937c4ebb9be51288acddfe23b070caf8aaf9ca732141027aaa921f61b4dc207fe08570a435c43c36
SHA1 hash: 3d2fdb7c51d722f0f1cdb2689e729a18a3e84c35
MD5 hash: cdf75b71d20bc563ce585a571926d704
humanhash: pip-illinois-oklahoma-romeo
File name:Request For Quotation (4).exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'483'776 bytes
First seen:2020-05-23 11:38:44 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3d95adbf13bbe79dc24dccb401c12091 (881 x AgentTesla, 737 x FormBook, 236 x SnakeKeylogger)
ssdeep 24576:Ctb20pkaCqT5TBWgNQ7aW+qclBYAQOaGme2Riswpfo/FDv6A:PVg5tQ7aWulBLafvRM9o/Fr5
Threatray 1'915 similar samples on MalwareBazaar
TLSH 8665CE1323DDC260D27F51737A557742AEBBB82525A1FC7B2FA4493CE8221214F0A66F
Reporter abuse_ch
Tags:exe NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: ilezoni.pw
Sending IP: 173.82.238.171
From: info <iinfo@ilezoni.pw>
Reply-To: purchase.depertment@my.com
Subject: Product List/Request For Quotation-05/20/2020
Attachment: Request For Quotation 4.gz (contains "Request For Quotation (4).exe")

NanoCore RAT C2:
91.193.75.46:1985

Hosted on nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@kgb-vpn.org'

inetnum: 91.193.75.0 - 91.193.75.255
netname: NON-LOGGING-VPN-SERVICE
descr: Please note that we don't store any user data.
descr: Our main effort is not to make money, but to preserve values like the
descr: freedom of expression, the freedom of press, the right to data protection
descr: and informational self-determination.
descr: We ask all employees of Spamhaus and all self-proclaimed deputy sheriffs
descr: to stop your attacks against us.
country: EU
admin-c: KA7109-RIPE
tech-c: KA7109-RIPE
org: ORG-KHd1-RIPE
status: ASSIGNED PI
mnt-by: RIPE-NCC-END-MNT
mnt-by: KGB-MNT
mnt-routes: KGB-MNT
sponsoring-org: ORG-MW1-RIPE
created: 2012-06-04T11:05:55Z
last-modified: 2019-12-05T05:39:00Z
source: RIPE


Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27686.AidExe.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.PSW.Agent.BORA.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Nanobot
Create hunting rule
Status:
Malicious
First seen:
2020-05-23 12:36:28 UTC
File Type:
PE (Exe)
Extracted files:
11
AV detection:
22 of 31 (70.97%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
1be97fde78848d5f414a09d31b63a422e30404d787a5467edede763c73e0bbbd
NanoCore
1c5653f7880f54b86f76ab009eb9775f3596d89e836d3d9bdb3c921612cb845b
NanoCore
384f36ad8c67b24aab276a4b5c295cc0b2f690ca97d9ba854bce80b8f1e2031d
NanoCore
43c22ad8da4c7b3702e70d5c97e7ceed85a50dbd7926fccc5eda0bd775fcec51
NanoCore
5f0f76108593d7ecc8a5932e244c0168947b173bf24369ced9793f9a034d04c5
NanoCore
8275f526465d7b9d806b1be78d895d7f499044b456be1aec36b8cac8188890ac
NanoCore
8d1512de63fd1bf66f80c8ec2ec640464a6ce986101849488372a38fed2bcfb6
NanoCore
944b633d92799fe6aeefae5de7945b6b0b69020ed669d9d7e68ebd80868771e6
NanoCore
bfefac71337cac5e66779e74fe6ba571620329ff9da8d7ce21999d90b46bcdb9
NanoCore
e9fc4844ee50f9e59616bd7238bfae3de6b8b194abf635e787e5a44d8658fe42
NanoCore
+ 1'905 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-dwh1s528fj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Drops startup file
NanoCore
Malware Config
C2 Extraction:
91.193.75.46:1985
127.0.0.1:1985
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

gz aafb0f41048fa685ee422501da7c13a6844b711ac5c8a2c794dfbc06d10ac91b

NanoCore

Executable exe 64bdaa17011415cb9a460a276b7cdc5824d69cb279d14691f313a71c24abbfd7

(this sample)

  
Dropped by
MD5 8d0a26a26d205f1ced02e25f0472fb0f
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 aafb0f41048fa685ee422501da7c13a6844b711ac5c8a2c794dfbc06d10ac91b

Comments