MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b966f74e284d7d7aa56bf43d1a8a4866e1141201740bdc50337b35161e2eb11a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b966f74e284d7d7aa56bf43d1a8a4866e1141201740bdc50337b35161e2eb11a
SHA3-384 hash: fca8c6cf8b1796d2fdefd080e768785c454375c0fb0674f3ad56c9b00a4ad040a726e9426acaea174285aec653fbb0ff
SHA1 hash: f29e1038c8811363448ed094cb5e3c894c058b4d
MD5 hash: 93c970b2907c5cc08866e4b30836327c
humanhash: alpha-river-beryllium-virginia
File name:invoice copy.pdf.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:445'952 bytes
First seen:2020-04-24 13:04:21 UTC
Last seen:2020-04-24 13:41:48 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 6144:2AL8M1tpZzATHEE6X+J6rXunb/q242rF3tIEsSer4DfmRRs4/bz0v3KRWk+q5Q5i:lv1zyoE0TXGjdcEsSe9/bRRWkT5
Threatray 1'097 similar samples on MalwareBazaar
TLSH 7A94E005179C1A4BCB7C05FDD041A603C3FA45926667F7890EC0B4F93A93798BEA678B
Reporter jarumlus
Tags:NanoCore

Intelligence

File Origin
# of uploads :
2
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.InjectNET.14.28297.26276.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-24 10:28:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xftpotrijv6xvjll6q6rvcsim3qrieqboqf5yubtpm2rmhrowena._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
33318539cfd16ce1d6f1cd45885d39c5534b8ccc6a81a64b53fb890b96fd9cee
NanoCore
4de20c38ffff3f9d75d9a446f152c017d9010477c28c8b97875f95f448ecb761
NanoCore
58dea698e2c5b2a9310769bd735db939a1b6ed8cc80fdbc3aa5f0f6e25a074fc
NanoCore
6d0f47774a21e610e5fdb8cf53a490e8534aacad7633d67a6919c7687f0ed974
NanoCore
7170afaea1dbb708d92f335dbcbf2677704d6abb91cb6d3f08cca0ed470d3dac
NanoCore
7cb0f80624431e1745d162ee3c2a4a25744f8d8fcbd95fe3c54f94214e826e0d
NanoCore
90474a0270106b33e3208a63041d2e4d013b1d2b415bf3bf44e9a5ab685d0531
NanoCore
97f67123bf9b506479f14240bb2045a9e5e12062039ad4a60c065232b293ea0c
NanoCore
de931e02ce90c509d5dcf1c3d53352809a909410c00796bdfa9f10514a37a627
NanoCore
fcde661a96a6352ae04e5127c9d1844079dbd05980564cef93bdd96069fce8a0
NanoCore
+ 1'087 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments