MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 122143663c7c3c1a476737764cb876845cdb9f98647c27af1a58f46942895d2f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	122143663c7c3c1a476737764cb876845cdb9f98647c27af1a58f46942895d2f
SHA3-384 hash:	2b8195de9890fcadce1c54ecff38874fd3b2ec59d127317d049bc6d88ecedb1bb2cb42ea0049d2d85eb8811fd3f17efa
SHA1 hash:	cc07d2ca7ad5f2418b8fb28abfef7397261fce03
MD5 hash:	dddd37e34fdf1724519bbcef88f32903
humanhash:	kentucky-island-bacon-iowa
File name:	scan003.scr
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	401'920 bytes
First seen:	2020-06-08 07:57:51 UTC
Last seen:	2020-06-08 09:12:04 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'612 x Formbook, 12'242 x SnakeKeylogger)
ssdeep	6144:ytbhv0MN2B+Pcg9qFRAzdEgoL8XTfBHmKv6Yf:otnN2Bicg8RmdZoL4Tptv6Y
Threatray	2'351 similar samples on MalwareBazaar
TLSH	2884A64090CE279AC82D807F65386238F126E3FF513BCB56B74C95B4626A3973617E8D
Reporter	abuse_ch
Tags:	NanoCore RAT scr

abuse_ch

Malspam distributing NanoCore:

HELO: vps.brersont.com
Sending IP: 45.95.169.22
From: Edit tacksang <edit@tack-sang.com>
Subject: Re: RFQ: Treat as Priority
Attachment: docscanner.rar (contains "scan003.scr")

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.MSIL.Packed.SmartAssembly.AY.14913.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Quasar

Status:

Malicious

First seen:

2020-06-08 07:59:04 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ciqugzr4pq6bur3hg53ezodwqronxh4ymr6cply2ld2gsqujluxq._file

Verdict:

malicious

NanoCore

2548272de2d930f99b953bf466d49d5f850f4f9105ff420937edfa9ae70aff7d

NanoCore

41f341ae994cf53488e0a96a6a531c9ef26c31ad763b7f858b278657051be31d

NanoCore

557fc548c91a029ed6f24456c57ac7c458fa53d2f042854297a167bdde569aff

NanoCore

5628310c6fe718d77dadbc5c8cb6238faa27942517b590c2a87c07aadca429d6

NanoCore

7f6459ace4d6259e61c8170563af8a30f25568457902f4f717c8ad17574efab6

NanoCore

83ba255722d5c337ce128b5e216fc1a4010849b3b4ac3e4841458d371ed757d6

NanoCore

bf58aecacc268c49d707512236a42c80cf096b24850c3096eb056f662ecbe2e3

NanoCore

c0e1210ec3e11a5d71cdbf2edfb199539f891a1bdb27ccd97eaf0fb70891c615

NanoCore

ceec91127018aba0be51981277015baf08e3f0ef6fbd0a5efe5821fa698ba645

NanoCore

+ 2'341 additional samples on MalwareBazaar

Result

Malware family:

formbook

Score:

10/10

Tags:

family:formbook rat spyware stealer trojan

Link:

https://tria.ge/reports/201109-kxklw7r3pa/

Behaviour

NTFS ADS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Loads dropped DLL

Formbook Payload

Formbook

Malware Config

C2 Extraction:

http://www.binzom.com/vy/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Formbook Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Formbook in memory
Reference:	internal research

Rule name:	win_formbook_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator