MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a2734857ca5d26ca4e6fd907472ec68dd756bf1bebfb48c7987795b013db922. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a2734857ca5d26ca4e6fd907472ec68dd756bf1bebfb48c7987795b013db922
SHA3-384 hash: cbd30ba3e6caccd639f36f0de307499b1a0e77779f8f16fbd84366e571f657839491e72656e26b09f8d333c4719a184c
SHA1 hash: 214e69c99519beb3fc742f54fe777bd36a94de17
MD5 hash: b35865915fcedd4ec170bdf87e166cb2
humanhash: xray-pasta-asparagus-lithium
File name:ABU.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:772'096 bytes
First seen:2020-06-18 14:51:57 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 90117697cc8be5d6ed7c153e6a15a30e (8 x AgentTesla, 3 x NanoCore, 2 x Loki)
ssdeep 12288:2zvyFcE4IMkvtlLnUHRyC0ZQXO7dEkPopRfQkxl2Lk+aH7Ogu:8GcUvtGoC02Ohz45Qkxl2ln
Threatray 2'699 similar samples on MalwareBazaar
TLSH 7FF49D27E2D0C437C1671E398F5B9774992EBE102A68A9466BF4DD4C9F3B3813835293
Reporter James_inthe_box
Tags:exe NanoCore

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/8741/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Variant.Graftor.775012.17510.17428.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.DelfFareIt
Create hunting rule
Status:
Malicious
First seen:
2020-06-18 14:51:30 UTC
File Type:
PE (Exe)
Extracted files:
265
AV detection:
29 of 31 (93.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=bittjbl4uxjgzjhg7wihi4xmndoxk27rx273jddzq54vwaj5xera._file
Verdict:
malicious
Label(s):
trickbot
Create hunting rule
nanocorerat
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
06cd18b13e77f513e826da358a65d6f61b05769ce830c8fb9d15b916c672ea61
NanoCore
1d5d33d83029cd0b64bd4171db3e6535c4f50d31cc585b6e2b10345121c346fc
NanoCore
3a8a04925d66b89b7cdb459aa6fc33e5132c447efcc541ab86e17b74f64a8287
NanoCore
4983921d3469aff39daaa738072cdf18171a7c98184a0a810c9d81daac7082e4
NanoCore
5901a8e4a36574b8ca6cb3c899e64cdfc27395de606cd4a512431e6dd827196f
NanoCore
5e4da067908b56292fc2595a72378a091feccd8090b6ba186db4287c94a68680
NanoCore
a498ac74ffd2f4ceccc802b5a42f33e067a7eb6f0b2125c3cf3668dd5c0c7833
NanoCore
bd23c3a3d5215798a115525fe15803ee5f4393ae77d49e081770761beecb14ea
NanoCore
bd6662e12b7b37965d97bc7527e72162b4128e6f859d1a8f4c0fb03bacc98484
NanoCore
bdddf5f5fa10f55e58819ff4ae4cf11902c3583503fa8fcf50ce67b1f1f66e4f
NanoCore
+ 2'689 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
evasion trojan keylogger stealer spyware family:nanocore
Link:
https://tria.ge/reports/200624-4bbwawdcv6/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
NTFS ADS
Creates scheduled task(s)
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Loads dropped DLL
Drops startup file
UPX packed file
Executes dropped EXE
NanoCore
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/8741/
  
URLhaus
https://urlhaus.abuse.ch/url/396605/

Comments