MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13687a295bb273d7d9f1c2eea25ce5ae3766b53f1192fb77a7db931e40e21c7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 12


Intelligence 12 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13687a295bb273d7d9f1c2eea25ce5ae3766b53f1192fb77a7db931e40e21c7b
SHA3-384 hash: 10616e3d73ea72ff683d03ee850135863ac003a6149437e5017402a84bd3986c2b097d24d5c7acd476f65d152c42d9a1
SHA1 hash: 777bfbb3b5e38a6d5da7db12fe33327b489a14fc
MD5 hash: 2f4d9aa14cdf33de7f6534bc5ce51eaa
humanhash: ink-pluto-steak-don
File name:HSBC Bank_Payment Advice_Pdf.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:37'888 bytes
First seen:2022-03-16 07:58:57 UTC
Last seen:2022-03-16 09:30:28 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'650 x Formbook, 12'246 x SnakeKeylogger)
ssdeep 384:yCH3ievxUMreueOdenPCimzH94l786mMzvWP9TzsymafVUMUO+agvNeszy:yc3xWnqimqFmMifVUmyW
Threatray 19'293 similar samples on MalwareBazaar
TLSH T1D303B302FA488370D356867BB4DEF20CE2969C1D020BDA97F9523E8B16723E19DF955C
File icon (PE):PE icon
dhash icon 64e4c8d0f0e8d4d4 (56 x AgentTesla, 7 x RemcosRAT, 5 x NanoCore)
Reporter abuse_ch
Tags:exe HSBC NanoCore

Intelligence

File Origin
# of uploads :
2
# of downloads :
228
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/251260/
Detection(s):
SecuriteInfo.com.W32.MSIL_Kryptik.GMM.genEldorado.11305.27806.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
DNS request
Sending an HTTP GET request
Running batch commands
Creating a process with a hidden window
Launching a process
Sending a custom TCP request
Creating a file in the %temp% directory
Creating a process from a recently created file
Creating a file in the %AppData% subdirectories
Creating a file
Creating a window
Searching for synchronization primitives
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/623199250cd58dbd92a504dc/reports/a68f5ab2-7c05-4a25-b4d6-2d4dc62934fd/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Formbook
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b5f7231c-a979-4c92-ba54-75140931139f
Result
Threat name:
Nanocore AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/957753
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Creates an undocumented autostart registry key
Detected Nanocore Rat
Executable has a suspicious name (potential lure to open the executable)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Initial sample is a PE file and has a suspicious name
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: NanoCore
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected AgentTesla
Yara detected Costura Assembly Loader
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 590232 Sample: HSBC Bank_Payment Advice_Pdf.exe Startdate: 16/03/2022 Architecture: WINDOWS Score: 100 41 Multi AV Scanner detection for domain / URL 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 21 other signatures 2->47 7 HSBC Bank_Payment Advice_Pdf.exe 15 8 2->7         started        process3 dnsIp4 35 bmn.lpmpbanten.id 103.8.79.204, 49761, 80 IDNIC-MTN-AS-IDPTMediatamaTelematikaNusantaraID Indonesia 7->35 25 C:\Users\user\AppData\Roaming\...\chrome.exe, PE32 7->25 dropped 27 C:\...\Buaxhktzbuvurwbkqrzzgezshootnano.exe, PE32 7->27 dropped 29 C:\Users\user\...\chrome.exe:Zone.Identifier, ASCII 7->29 dropped 31 C:\...\HSBC Bank_Payment Advice_Pdf.exe.log, ASCII 7->31 dropped 49 Creates an undocumented autostart registry key 7->49 51 Injects a PE file into a foreign processes 7->51 12 Buaxhktzbuvurwbkqrzzgezshootnano.exe 8 7->12         started        17 cmd.exe 1 7->17         started        19 HSBC Bank_Payment Advice_Pdf.exe 2 7->19         started        file5 signatures6 process7 dnsIp8 37 23.105.131.196, 49773, 49780, 49782 LEASEWEB-USA-NYC-11US United States 12->37 39 127.0.0.1 unknown unknown 12->39 33 C:\Users\user\AppData\Roaming\...\run.dat, Non-ISO 12->33 dropped 53 Antivirus detection for dropped file 12->53 55 Multi AV Scanner detection for dropped file 12->55 57 Machine Learning detection for dropped file 12->57 59 Hides that the sample has been downloaded from the Internet (zone.identifier) 12->59 21 conhost.exe 17->21         started        23 timeout.exe 1 17->23         started        file9 signatures10 process11
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/13687a295bb273d7d9f1c2eea25ce5ae3766b53f1192fb77a7db931e40e21c7b/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-03-16 08:01:27 UTC
File Type:
PE (.Net Exe)
Extracted files:
4
AV detection:
19 of 27 (70.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cnuhukk3wjz5pwprylxkexhfvy3wnnj7cgjpw55h3ojr4qhcdr5q._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
nanocorerat
Create hunting rule
Similar samples:
0cbbdd2c9615f4d2de4e0232ace6b69889a54538444838ac6616a5aa39109c98
NanoCore
623d707cab5c5dc378a5100018e29f88949f4ea4be4b34cc2fc36e1612b68100
NanoCore
68bf0a42854ac13fe13a75bb213f51934a3edc0fa7a0732ddb12a68699619474
NanoCore
6b68f82534d3741e2e20d707a45831fb294a61a2facd1e67b0bd0836886375e8
NanoCore
7a388ead62a8f818b36c9c9a1938c2172c4fa05edfc71307980131c53c69d054
NanoCore
7da044c42ca2197b24b974350ae45f50ba9573714685c175026ff4a29a57973b
NanoCore
7e1c04108960d9e729d34963b1541487bc29b232566a2b0e0abfb420d454645d
NanoCore
b07ef4c584528991957dfbc17e62984fe06a6ae8ab441062b3d6910bbedf36b5
NanoCore
cac57f9210fa4d8fb970249750db6886d99f31e503cdeb6e4641bf1c0055afe7
NanoCore
ddaaa650d42caaed5ddd7c307b986cdccfc25bcb84c7a4f29f9fddd26add4135
NanoCore
+ 19'283 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla family:nanocore keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220316-jvfggaagh4/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
AgentTesla Payload
AgentTesla
NanoCore
Malware Config
C2 Extraction:
23.105.131.196:9070
127.0.0.1:9070
Unpacked files
SH256 hash:
13687a295bb273d7d9f1c2eea25ce5ae3766b53f1192fb77a7db931e40e21c7b
MD5 hash:
2f4d9aa14cdf33de7f6534bc5ce51eaa
SHA1 hash:
777bfbb3b5e38a6d5da7db12fe33327b489a14fc
Link:
https://www.unpac.me/results/2a2cff73-f180-4ec4-9c21-56776edf0952/
Malware family:
NanoCore
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/13687a295bb2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
Link:
https://yomi.yoroi.company/submissions/13687a295bb273d7d9f1c2eea25ce5ae3766b53f1192fb77a7db931e40e21c7b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

Executable exe 13687a295bb273d7d9f1c2eea25ce5ae3766b53f1192fb77a7db931e40e21c7b

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/251260/

Comments