MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c6160c54544837983276438a2b3d4782a52ae0fc604f4f65a8b16133f99ab16e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 5

Intelligence 5 IOCs YARA 5 File information Comments

SHA256 hash:	c6160c54544837983276438a2b3d4782a52ae0fc604f4f65a8b16133f99ab16e
SHA3-384 hash:	a16e9b4f1172a63f69aa212e1b473f7b0b9b538e76fca14f180fabab03ec94711d617394f2fe189dbb1037b066d39526
SHA1 hash:	23e0a7e66244ff56c33d9f67ca4e631d42246de3
MD5 hash:	e2601d16c3a1fc0bc9b1922c095b717e
humanhash:	eight-hot-music-winter
File name:	P.O 428223.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	402'944 bytes
First seen:	2020-05-15 07:18:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep	6144:+M0zdDptd1tz6zwxzrOmjLgB69af9171b892C1Xc3i525M8BVrtd:+HzdDFzdltLg8UzFd93iw5MS
Threatray	1'130 similar samples on MalwareBazaar
TLSH	0B84C07E31AC0E33C47D29FA4CE1124443F97519395BEFCA8DC164EB26E07A587AA44B
Reporter	abuse_ch
Tags:	exe NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

From: Sayed Moustafa <user@ksc-tth.com>
Subject: RE: Enquiry from Dubai,U.A.E, please check.
Attachment: P.O 428223.rar (contains "P.O 428223.exe")

NanoCore RAT C2:
79.134.225.89:7777

Hosted on nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Kryptik

Status:

Malicious

First seen:

2020-05-14 23:29:26 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

25 of 31 (80.65%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=yylayvcuja3zqmtwiofcwpkhqkssvyh4mbhu6zniwfqth6m2wfxa._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

080a6fbf91637b683b6f363092f9b7d6e75b8442c6f9df32ffea0788e16fafdf

NanoCore

619a5e8a0ade93b187c7f438bcb7c5bb15a33da3148176513a2c0010c7960cd4

NanoCore

7cdf1294eb40f2a207f55cbb1a68761135500f64bb077a7f4ba9a7d3098850f1

NanoCore

8b8b052e997171b0f6d09e387540b184e17f57ff8e3e4ea844840112d3e450ef

NanoCore

abf941273866ba3ff5790c18f55e776554f75f846f1878b98c1e98ad25e94b9e

NanoCore

b4a60a5fdddebf1351aa77b5ae1b850c8f53312cbe7e3792a0adbd3a458c70ba

NanoCore

cd041f14ff9c62fb4e6c474dbfb2dc8905b1680c8d58063d7e24381cef97a779

NanoCore

ddf157853be3dbebba9eea0db9815017a0c7d8dded210a5c291d7b0ccd2fd2be

NanoCore

f0eeb908857a4ce55d061a72ce18cb9caf486d350e1904c398ff9624fa2bd9cc

NanoCore

+ 1'120 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

family:nanocore evasion keylogger spyware stealer trojan

Link:

https://tria.ge/reports/201109-w653fgcz9e/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Checks whether UAC is enabled

NanoCore

Malware Config

C2 Extraction:

79.134.225.89:7777

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/