MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b227a11aa15b176c7d63d4aacbfcf8cd70bfa8f457d4d762053c559cd31435a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 6

Intelligence 6 IOCs YARA 5 File information Comments

SHA256 hash:	0b227a11aa15b176c7d63d4aacbfcf8cd70bfa8f457d4d762053c559cd31435a
SHA3-384 hash:	0271b27947c534df98fb5f54f27e112ed856af899b61a95299a53b57235cf07fc9f82a5d34ab796664d9c01e30727e47
SHA1 hash:	3f4019588d8a80dfb1e6373db0a21555928b8dd3
MD5 hash:	921cd5f4ec6437efb66336eb2979ab5f
humanhash:	edward-early-oxygen-artist
File name:	RFQ0615.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	371'712 bytes
First seen:	2020-06-15 12:42:22 UTC
Last seen:	2020-06-16 09:35:13 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep	6144:0wCrxZngefLglXKhgrdQoplmZ2v9ug1H/1f/sZ5r11n:0Z1ZJTGKPoTl1HGH
Threatray	1'398 similar samples on MalwareBazaar
TLSH	EF84F1163BDD5B21E1B99B3688F255808370B8A76A23F38E5FC430BA1973BC19552F17
Reporter	abuse_ch
Tags:	exe NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: serve0.yangtwang.pw
Sending IP: 142.11.195.30
From: Rohit Nikam < hr@yangtwang.pw>
Reply-To: sjrkintluea@gmail.com
Subject: RFQ Division Project (REFU, GmbH).
Attachment: RFQ0615.arj (contains "RFQ0615.exe")

NanoCore RAT C2:
185.165.153.26:1985

Hosted on nVpn:

% Information related to '185.165.153.0 - 185.165.153.255'

% Abuse contact for '185.165.153.0 - 185.165.153.255' is 'abuse@privacy-matters.co'

inetnum: 185.165.153.0 - 185.165.153.255
netname: PRIVACY_MATTERS
remarks: This prefix belongs to a VPN service provider.
remarks: For us the privacy of our customers matters, which means we store no logs
remarks: related to any IP addresses.
remarks: Spamhaus, please note that blacklisting the clean prefixes of our hosting
remarks: partners and upstream providers is an act of coercion and will no longer
remarks: be tolerated.
remarks: Coercion is punishable by a custodial sentence or by a monetary penalty.
remarks: If you continue such practice we will not only take legal actions against
remarks: your organization, but also make such blackmailing attempts public in the
remarks: media.
country: AT
admin-c: PMVS3-RIPE
tech-c: PMVS3-RIPE
org: ORG-PMVS1-RIPE
status: ASSIGNED PA
mnt-by: PM-MNT
created: 2019-10-18T12:14:26Z
last-modified: 2019-10-18T13:31:16Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

NanoCore

Link:

https://www.capesandbox.com/analysis/10403/

Detection(s):

SecuriteInfo.com.Generic.mg.80fc162f354d28e3.20640.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.FormBook

Status:

Malicious

First seen:

2020-06-15 12:44:05 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

25 of 31 (80.65%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=bmrhuenkcwyxnr6whvfkzp6prtlqx6upiv6u25rakpcvttjrinna._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

70e32f51fdd7cbade222e6e7acc86c8982eba7b1e591449dcaf2566946104d11

NanoCore

77aed51893a8a5e2ab24824dddad42c99cfb46baba36dbe90c72cd8ff6723b7f

NanoCore

8e5c41390f995c72ea749d6f141ec790ab5a61e843355592c2956ee01d8bb005

NanoCore

9570bbdb530065408a2c3d51801fcbb4bd0e5de8ce10b71096dcc8eac4571988

NanoCore

97f67123bf9b506479f14240bb2045a9e5e12062039ad4a60c065232b293ea0c

NanoCore

a388721677699e1816b5a7812b0c7bfa301cbe1539aae18fad07c98f85e16168

NanoCore

ccd5df3e21e1543a8cb3f92b37276be48adec9859f12096faaca589a39a0f99b

NanoCore

e4a764560fc747261834c1568d5280725a64036f720ad42ce847353cb4841331

NanoCore

f680bde2f9df0bf77497f36b16e0b1a8b08c847b4e9be02f9842e7d457169437

NanoCore

+ 1'388 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

family:nanocore keylogger persistence spyware stealer trojan

Link:

https://tria.ge/reports/201109-2z9l6k2cfn/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Suspicious use of SetThreadContext

Adds Run key to start application

NanoCore

Malware Config

C2 Extraction:

185.165.153.26:1985
127.0.0.1:1985

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/