MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2e9a56a20c71306ae8965955dfa780b868c5766f3ebb2f8e4c816a305711cdd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 10


Intelligence 10 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2e9a56a20c71306ae8965955dfa780b868c5766f3ebb2f8e4c816a305711cdd
SHA3-384 hash: 6e74b903d902007b23a12df88dab72d1fcc0aab7ea2479194cc1790361b04ea8d54c6d1aaac3a4a927fd5a8b632bc02d
SHA1 hash: 02d6171e475f2785314bef8e7958daf739cf89ef
MD5 hash: cff4580cff0f2335161feb5446ca17a8
humanhash: iowa-alaska-jersey-connecticut
File name:easiyo.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'056'768 bytes
First seen:2020-08-05 09:05:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 12288:QNXpjdEp2RT98KOxGxLsJtwON7dOxs65q5LIftOEIcxCxsokwW3W8zAZZetcoVsp:PZYSqHV71kzgTctpwKpwhlZXf8
Threatray 1'117 similar samples on MalwareBazaar
TLSH 9725E0A23948CF64D97E17313837A440EBF2BD09DF60E60EFD9531AD1B71A894E26709
Reporter abuse_ch
Tags:exe NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: slot0.yougurnu.com
Sending IP: 104.168.172.35
From: info@yougurnu.com
Subject: FW: RE: R29011CA CULTURE LS267 8603 - URGENT
Attachment: easiyo.rar (contains "easiyo.exe")

NanoCore RAT C2:
dolphnindia.duckdns.org:6543 (79.134.225.75)

Pointing to nVpn:

% Information related to '79.134.225.0 - 79.134.225.127'

% Abuse contact for '79.134.225.0 - 79.134.225.127' is 'abuse@privacyfirst.sh'

inetnum: 79.134.225.0 - 79.134.225.127
netname: PRIVACYFIRST-EU
country: EU
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
org: ORG-TPP6-RIPE
created: 2020-07-14T15:26:02Z
last-modified: 2020-07-14T15:31:06Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/39286/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Creating a file
Creating a file in the %AppData% subdirectories
DNS request
Sending a TCP request to an infection source
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Threat name:
Nanocore AveMaria MailPassView
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/410715
Signature
.NET source code contains potential unpacker
Detected Nanocore Rat
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to steal Instant Messenger accounts or passwords
Tries to steal Mail credentials (via file access)
Tries to steal Mail credentials (via file registry)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected AveMaria stealer
Yara detected MailPassView
Yara detected Nanocore RAT
Yara detected WebBrowserPassView password recovery tool
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 257626 Sample: easiyo.exe Startdate: 05/08/2020 Architecture: WINDOWS Score: 100 48 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->48 50 Malicious sample detected (through community Yara rule) 2->50 52 Sigma detected: Scheduled temp file as task from temp location 2->52 54 13 other signatures 2->54 8 easiyo.exe 7 2->8         started        11 MSBuild.exe 2 2->11         started        process3 file4 34 C:\Users\user\AppData\Roaming\UNvarOOkx.exe, PE32 8->34 dropped 36 C:\Users\...\UNvarOOkx.exe:Zone.Identifier, ASCII 8->36 dropped 38 C:\Users\user\AppData\Local\...\tmpEFA9.tmp, XML 8->38 dropped 40 C:\Users\user\AppData\...\easiyo.exe.log, ASCII 8->40 dropped 13 MSBuild.exe 11 8->13         started        18 schtasks.exe 1 8->18         started        20 conhost.exe 11->20         started        process5 dnsIp6 46 dolphnindia.duckdns.org 79.134.225.75, 49739, 6543 FINK-TELECOM-SERVICESCH Switzerland 13->46 42 C:\Users\user\AppData\Roaming\...\run.dat, Non-ISO 13->42 dropped 62 Hides that the sample has been downloaded from the Internet (zone.identifier) 13->62 22 vbc.exe 1 13->22         started        25 vbc.exe 13 13->25         started        28 schtasks.exe 1 13->28         started        30 conhost.exe 18->30         started        file7 signatures8 process9 dnsIp10 56 Tries to steal Mail credentials (via file registry) 22->56 58 Tries to steal Instant Messenger accounts or passwords 22->58 60 Tries to steal Mail credentials (via file access) 22->60 44 192.168.2.1 unknown unknown 25->44 32 conhost.exe 28->32         started        signatures11 process12
Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/b2e9a56a20c71306ae8965955dfa780b868c5766f3ebb2f8e4c816a305711cdd/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-08-05 04:13:40 UTC
AV detection:
23 of 29 (79.31%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wlu2k2ray4jqnlujmwkv36tybodiyv3g6pv3f6hezalkgblrdtoq._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
04465041b9f3a9907c9c92d39ae2d375a464047601c68238cc56071a5e9f58fe
NanoCore
1c85e967c0c5b4a332aabcec26d9df72c5a3e959f317ebe08202671e3ec254ec
NanoCore
38eb441454dd6b9459981660281d748fc8d5052a07b15597d317a3fec3b72400
NanoCore
5568021e42a81a2755fd6d968efa50b13f99a9997d8973097231079de84832ad
NanoCore
760dd5e8864e9c94296e285f17ce5b67c9c36d462cd301fa5a72e20b6c97df33
NanoCore
78bb05f8287c0a41174d810b2e9954b3010b523777ba521ba8336219501bded4
NanoCore
b1dfcf175d2aeff612c4aada38df796c1f4687caacd0b26e02f66485d5a32899
NanoCore
b91d1df833c959a0c941ea92dae9d30f23cb4825ae33594da4eafc758a8de10f
NanoCore
d44ec72ea7ed650ad5ae4102ef8b60397673335a4471f2537cf6f5933cc8bf49
NanoCore
d826e50de7b11772bc48d32d0f75b72a7975e469cfe9583a51edbd9bbaa58387
NanoCore
+ 1'107 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
evasion trojan keylogger stealer spyware family:nanocore
Link:
https://tria.ge/reports/200805-za4t5vjf3a/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
dolphnindia.duckdns.org:6543
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b2e9a56a20c71306ae8965955dfa780b868c5766f3ebb2f8e4c816a305711cdd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar 62f0ecc3291f8faccd1144347338bb88666fd3c3c41621b6d63090ec50d90742

NanoCore

Executable exe b2e9a56a20c71306ae8965955dfa780b868c5766f3ebb2f8e4c816a305711cdd

(this sample)

  
Dropped by
MD5 a580a0ae302dbd52464ddb413a77f5f9
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/39286/
  
Dropped by
SHA256 62f0ecc3291f8faccd1144347338bb88666fd3c3c41621b6d63090ec50d90742

Comments