MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0bdd59b67a442209f68d9adf125fbadd7e99324ca917822d5f5f29e976b5b26. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 10

Intelligence 10 IOCs YARA 5 File information Comments

SHA256 hash:	f0bdd59b67a442209f68d9adf125fbadd7e99324ca917822d5f5f29e976b5b26
SHA3-384 hash:	d0151e099c0f5fa7f1792ebfe1e2658b913cc744298e826ab49fb56c301b2e0d8565145ff043421fbf90c3d26cb01340
SHA1 hash:	142947a1c23026c9dd723979bf8fd16d4f0e5f8b
MD5 hash:	37ca2dcb84070656527a45c9b3ff8589
humanhash:	ohio-alabama-mexico-sodium
File name:	PURCHASE ORDER.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	518'656 bytes
First seen:	2020-07-21 07:43:00 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'649 x AgentTesla, 19'461 x Formbook, 12'202 x SnakeKeylogger)
ssdeep	6144:X+fUYeG3jMKe8w/NHxpFhP64qbJRS6lc2RpETN4GMHaNJRROQKCbBpv9dyRw6TBW:XhP4JoGVp2N43d9+BXKI
Threatray	1'225 similar samples on MalwareBazaar
TLSH	ACB46A10D7B84AD9E3BA57BCE870001087B2BC0AA7E6E7590B95F0E91932751DB13F67
Reporter	abuse_ch
Tags:	exe NanoCore RAT

abuse_ch

Malspam distributing NanoCore:

HELO: sv1.per.eftel.com
Sending IP: 203.24.101.178
From: Taimi Sjöström <brysylv9@pnc.com.au>
Reply-To: Taimi Sjöström <purchase-team@citofoniarintec.cl>
Subject: New Order.
Attachment: PURCHASE ORDER.PDF.gz (contains "PURCHASE ORDER.exe")

NanoCore RAT C2:
apaduckdns.duckdns.org:54984 (46.243.144.12)

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

NanoCore

Link:

https://www.capesandbox.com/analysis/29837/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %AppData% directory

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Creating a file

Creating a file in the %AppData% subdirectories

Creating a file in the Program Files subdirectories

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Connection attempt to an infection source

Enabling autorun with Startup directory

Unauthorized injection to a system process

Detection:

nanocore

Link:

https://mwdb.cert.pl/sample/f0bdd59b67a442209f68d9adf125fbadd7e99324ca917822d5f5f29e976b5b26/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2020-07-21 07:44:09 UTC

AV detection:

23 of 29 (79.31%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=6c65lg3hurbcbh3i3gw7cjp3vxl6tezezkixqiwv6xzj5f3llmta._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

14e5f96ae6b8740535a954d5e0add90e7f41b5839dae197a8f1d6e89dc5708db

NanoCore

1583c29f396b51c03866ecbac92dfae57d41c361d8f6f5ae71600a84a4b9033d

NanoCore

1a32b479225283f435fe37ea7490bd319063d0cbf88ba6845821aa4eadbbdc91

NanoCore

65985974e8e5863fee10f22f30f9e3bc80a0ceca168abfec3431e0753f080b39

NanoCore

7fc2806d0821e5367c81773db3f59020ca283312b9975ef3ee19c139af0a4d69

NanoCore

b6e6a78efe43a85893d398bdcb56f913b48e5ab649bbac0ea305177ef55a0747

NanoCore

d1bd877b6b748426000286d808fd8a397869e91f2e400aa328a290363b57fa0b

NanoCore

d8a940109eb53d9f23207bea365e2a265ad1b4ba479821085e7f930629532152

NanoCore

eccb7dad3a4bff889e8f54ab9dd8603443cb62ffba05140d5cdaedb057e1486b

NanoCore

+ 1'215 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

evasion trojan keylogger stealer spyware family:nanocore persistence

Link:

https://tria.ge/reports/200721-nfy8mw32fn/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Drops file in Program Files directory

Suspicious use of SetThreadContext

Checks whether UAC is enabled

Adds Run key to start application

NanoCore

Malware Config

C2 Extraction:

apaduckdns.duckdns.org:54984

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Unknown

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f0bdd59b67a442209f68d9adf125fbadd7e99324ca917822d5f5f29e976b5b26

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/