MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ece00da69537d12d933cfc710ef0be2f76ee8d39c111ba1726bd47c8fb8acb1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 6


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6ece00da69537d12d933cfc710ef0be2f76ee8d39c111ba1726bd47c8fb8acb1
SHA3-384 hash: aa6b140407fd1d119d281d60a5630e54d8f8f2033d6863d0a5bcc4c3627e5e9e0d1f2545a6de2e769b990bf6b2a80079
SHA1 hash: b22b789acafface4f0d1140d8f12ef425d8da1b6
MD5 hash: 474f0117b9ffba8ab212f72abb791b45
humanhash: dakota-white-muppet-nine
File name:7DcshRRKyE3bON7.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:337'408 bytes
First seen:2020-06-30 13:13:12 UTC
Last seen:2020-07-06 07:03:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 6144:bBBWUCt60fvNo0/HrX7xlvN0HshnpP285aIoOODr:bBBWUCtLvNoGbdlvnnpusG
Threatray 1'246 similar samples on MalwareBazaar
TLSH DF74023363B85F16D2FA97B910B1A5210F76A8133E24D65DADA860CE1D73B944B12F33
Reporter abuse_ch
Tags:exe NanoCore nVpn Outlook RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: NAM11-DM6-obe.outbound.protection.outlook.com
Sending IP: 40.92.19.32
From: susana_figueirinha@hotmail.com
Reply-To: vojtech.tydlacka@yandex.com
Subject: Early July Supply order request..
Attachment: SotaiyoGroup-RFQ20200701.xz (contains "7DcshRRKyE3bON7.exe")

NanoCore RAT C2:
nobiwideget.dvrdns.org:54001 (5.206.224.136)

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/17200/
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/6ece00da69537d12d933cfc710ef0be2f76ee8d39c111ba1726bd47c8fb8acb1/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 09:40:36 UTC
File Type:
PE (.Net Exe)
Extracted files:
14
AV detection:
22 of 29 (75.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=n3habwtjkn6rfwjtz7drb3yl4l3w52gttqirxilsnpkhzd5yvsyq._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
01956570f3d4747162a5b0c381bd39c843ac0a50c9355cecc621cfe9ae10a6df
NanoCore
26f45dc6e383ee31df6aabe8a5b4ecc625b76631f2a377803622a2990f3a8408
NanoCore
290fb785e3b59196b2c3d474822f7dd18eaa9d13526c19b9f5dfd51ba3cb4756
NanoCore
5106eff2035cae4bc844f175750857ecffe095b70f7872ddd212bedce7776e80
NanoCore
58dea698e2c5b2a9310769bd735db939a1b6ed8cc80fdbc3aa5f0f6e25a074fc
NanoCore
68b92d885a2b75a1a44e909c4fbb5221c9328161c51bf9982009189cc01e8dec
NanoCore
6cd7b1c8e3b06ac38919582b023c8204f07277d17b612a98ddb0cc574e2aa991
NanoCore
c166a4a1899462e20516825c87f9545cdc7b24654d1f18b864da4ee641af5ace
NanoCore
dd02cb85d94d9d687d5de330f198abd8f1a84720947c03dfad880526830986f3
NanoCore
e5f63380b0e4ad92c5e1827b4e72e307ea1d0928ee8a223ee041495923acacac
NanoCore
+ 1'236 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
evasion trojan keylogger stealer spyware family:nanocore persistence
Link:
https://tria.ge/reports/200630-ck6p79dswx/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: GetForegroundWindowSpam
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
nobiwideget.dvrdns.org:54001
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

xz b12d23e2ebb552bcc7a40011b72895f11c30bac92f745c2598904200b48f6e75

NanoCore

Executable exe 6ece00da69537d12d933cfc710ef0be2f76ee8d39c111ba1726bd47c8fb8acb1

(this sample)

  
Dropped by
MD5 381cbcd693ad6fe9f3a59b88a26eee7a
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/17200/
  
Dropped by
SHA256 b12d23e2ebb552bcc7a40011b72895f11c30bac92f745c2598904200b48f6e75

Comments