MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8a0c1d5363ff53775a0efa19229b82d0b4934232929aec50034a35a56f8d035. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8a0c1d5363ff53775a0efa19229b82d0b4934232929aec50034a35a56f8d035
SHA3-384 hash: f47450e95834fbba9f4bd6d1f772ec846edce1f2f641226309c05b1d756e2881989821b4d44521e2de615c199dfbcb49
SHA1 hash: a40df6aa70dacc7114020dd0bc42807a574a1489
MD5 hash: a5a4d8d1e52f077ba8458e2b58044398
humanhash: sink-quebec-emma-massachusetts
File name:Invoice Ex 21x40HQ---urgent (2).exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:841'216 bytes
First seen:2020-03-24 14:01:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d2903cd9b5bd992bb59d25799a3e66d9 (3 x Loki, 1 x AgentTesla, 1 x NanoCore)
ssdeep 24576:DKAVRuNNZ87AW/fJ1V5scifX9d8bpCvxM:DKvLq7Yv9d8su
Threatray 2'535 similar samples on MalwareBazaar
TLSH C905BF22F1D34437C1732A3C9D7B57649B2ABD412E28A84E67E41D6C8F396A0353B2D7
Reporter cocaman
Tags:exe NanoCore

Intelligence

File Origin
# of uploads :
1
# of downloads :
92
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.Siggen9.25054.18584.3389.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-03-24 16:50:24 UTC
File Type:
PE (Exe)
Extracted files:
36
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xcqmdvjwh72to5na56qzeknyfufusnbdfeu25riagsrvuvxy2a2q._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
3874eba497e0b61949d0772430ce1df420e28777dba850a6033295212e9de9c5
NanoCore
38bf20255640821b131eaa9c22c16a6e55e61e18a6cd4e248aa07b919847d626
NanoCore
3c885c97705c854c6788021733c47f2763a30f8e7757aeb99e602ed1576e4fef
NanoCore
4de6466841226eea95bef6fe6868d1c3d5808d8fafa3449e333f0b6d03253c84
NanoCore
848a1e3268f513f59bf238fb63fe53afe5e6dc7b3b5bff421bbf4cb3683ab8f2
NanoCore
8c597485c8789aeb7f4edef9a49fc83a39346ea4d9f31f51b92f27b77ed8af0d
NanoCore
aaa969de94835c4f59740b9bc3463693142db72d094969962d353c6466c10cd5
NanoCore
bf690b9b4ab2e0306b94b1a09431878786eb0fd6e858ac1f5d21c29a78b1f8d0
NanoCore
d1398a54275d65d1bbb0f8937e4de1263dc5293586d58d8140418c9ee162e27c
NanoCore
d832b9d26b8e022fb064d68edfcdc6e33a464fdd854f03c58d0e25b5ed9015ed
NanoCore
+ 2'525 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

gz 225bfeff04449cc6befac6f17506eccba8578b4b4b31dafbaa1386533744b024

NanoCore

Executable exe b8a0c1d5363ff53775a0efa19229b82d0b4934232929aec50034a35a56f8d035

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 225bfeff04449cc6befac6f17506eccba8578b4b4b31dafbaa1386533744b024
anyrun
any.run
https://app.any.run/tasks/81befee6-c580-412f-8a93-b183ad7be423

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
wininet.dll::InternetCloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::FindFirstFileA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_BASE_USER_APIRetrieves Account Informationkernel32.dll::GetComputerNameA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegOpenKeyA
advapi32.dll::RegQueryValueExA
advapi32.dll::RegQueryValueA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments