MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd02cb85d94d9d687d5de330f198abd8f1a84720947c03dfad880526830986f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 7


Intelligence 7 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd02cb85d94d9d687d5de330f198abd8f1a84720947c03dfad880526830986f3
SHA3-384 hash: 7210581d799caff8651df7a573cb0c48a680fd7ef8beda60700f28a1a7482e0b0ac16687e7e3de74558f86cf541adb7f
SHA1 hash: 6346ac10485dfb99bbf1a2570d306feacda3f7ba
MD5 hash: 4c05e57f9047e2206f9e1d168fa06481
humanhash: virginia-utah-artist-wolfram
File name:ZtwPj90AM5uNjVx.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:399'872 bytes
First seen:2020-06-30 13:01:34 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'650 x AgentTesla, 19'462 x Formbook, 12'203 x SnakeKeylogger)
ssdeep 12288:150wIFoIhsZPepc9o14X062vkO/AzQ7p4onflVMg:150wIFoIho2pc/SvkWp4m4g
Threatray 1'520 similar samples on MalwareBazaar
TLSH 3A84F174E7A58724DEBA67B050A218500FB7BE6B3D70D26E6D1870CA6F73BC14121B27
Reporter abuse_ch
Tags:exe NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: mail.gsoft.com.uy
Sending IP: 200.40.204.69
From: Toyo Engineering & Construction Sdn. Bhd <nmg_ikram@toyo-eng.com>
Subject: [PR259 BIO-MEG] AYBF001 Hot Oil Heater / RFQ / Toyo Engineering & Construction Sdn. Bhd
Attachment: TOYO Engineering EPCC for BIO-MEG.ARJ (contains "ZtwPj90AM5uNjVx.exe")

NanoCore RAT C2:
91.193.75.58:1985

Hosted on nVpn:

% Information related to '91.193.75.0 - 91.193.75.255'

% Abuse contact for '91.193.75.0 - 91.193.75.255' is 'abuse@kgb-vpn.org'

inetnum: 91.193.75.0 - 91.193.75.255
netname: NON-LOGGING-VPN-SERVICE
descr: Please note that we don't store any user data.
descr: Our main effort is not to make money, but to preserve values like the
descr: freedom of expression, the freedom of press, the right to data protection
descr: and informational self-determination.
country: EU
admin-c: KA7109-RIPE
tech-c: KA7109-RIPE
org: ORG-KHd1-RIPE
status: ASSIGNED PI
mnt-by: RIPE-NCC-END-MNT
mnt-by: KGB-MNT
mnt-routes: KGB-MNT
sponsoring-org: ORG-MW1-RIPE
created: 2012-06-04T11:05:55Z
last-modified: 2020-06-12T19:27:12Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/17178/
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/dd02cb85d94d9d687d5de330f198abd8f1a84720947c03dfad880526830986f3/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2020-06-30 13:03:05 UTC
AV detection:
21 of 29 (72.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ubmxbozjwowq7k54mypdgfl3dy2qrzasr6ahx5nracsnayjq3zq._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
26f45dc6e383ee31df6aabe8a5b4ecc625b76631f2a377803622a2990f3a8408
NanoCore
290fb785e3b59196b2c3d474822f7dd18eaa9d13526c19b9f5dfd51ba3cb4756
NanoCore
3964739a8988be3dc3ffe71ce4fdd86bfef579f4cfdfac1c97d123805cd0ea2a
NanoCore
3e0a5536a96d3ea0b97b034c193bcb933f2dd8dfc8e159915951ab3842630b20
NanoCore
4f5bf279812fb7f1276a7ce23071b23b6c9fc38938d52b846f060087285bdb41
NanoCore
68b92d885a2b75a1a44e909c4fbb5221c9328161c51bf9982009189cc01e8dec
NanoCore
6ece00da69537d12d933cfc710ef0be2f76ee8d39c111ba1726bd47c8fb8acb1
NanoCore
be1a45ae85bb530727a5e96d3dc19eeb0542991ddb5a747b93665b4599c70ea0
NanoCore
e5f63380b0e4ad92c5e1827b4e72e307ea1d0928ee8a223ee041495923acacac
NanoCore
e8254b66674540a3ccd19360e61beca8337a93af404f3486dca84a5bcdb3abd4
NanoCore
+ 1'510 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
evasion trojan keylogger stealer spyware family:nanocore persistence
Link:
https://tria.ge/reports/200630-e8s6xnjkyn/
Behaviour
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
91.193.75.58:1985
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

arj fd8609886387d51b739c5aead9eb3b9d667623976b6c14e93b7233f8c6015b55

NanoCore

Executable exe dd02cb85d94d9d687d5de330f198abd8f1a84720947c03dfad880526830986f3

(this sample)

  
Dropped by
MD5 0de0a07525b7e93410c347e5dc0d0a2a
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/17178/
  
Dropped by
SHA256 fd8609886387d51b739c5aead9eb3b9d667623976b6c14e93b7233f8c6015b55

Comments