MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1487f4e41d24b3440b5d87ca47a899f799f831824bd4d6dd8bb506637157a8ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 7

Intelligence 7 IOCs YARA 6 File information Comments

SHA256 hash:	1487f4e41d24b3440b5d87ca47a899f799f831824bd4d6dd8bb506637157a8ec
SHA3-384 hash:	079b1e01b280cd94dfe10266051916f0b3e803d244fac520614e5e51d367ee9733cd06e339fd6640a629b4041f90b2d6
SHA1 hash:	4bddf8318b27fb3a6d60da7f323e8456cc423da5
MD5 hash:	b82a2c603292c4643e5b63e1337a3ae8
humanhash:	fourteen-nevada-fish-echo
File name:	Cheque against PI no 234443.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	750'080 bytes
First seen:	2021-02-09 12:15:10 UTC
Last seen:	2021-02-09 14:18:02 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'660 x AgentTesla, 19'470 x Formbook, 12'208 x SnakeKeylogger)
ssdeep	12288:cCWzDb7lQLvvfqeo9DlzlPtSTsuRY/TFhMEG9IsK62BnP45PT:cCWzDb7avBulXduRYrc9IZVw5PT
Threatray	4 similar samples on MalwareBazaar
TLSH	53F4E03612C89B54E0BD9B7D0274481563F2EE12D723DA5EBEAC73D84AB3B454237A07
Reporter	abuse_ch
Tags:	exe GoDaddy NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: sg2nlshrout02.shr.prod.sin2.secureserver.net
Sending IP: 182.50.132.194
From: Rakesh<rakesh@sterlingduro.com>
Subject: Reply to PI #234443 and awaiting further briefing
Attachment: Cheque against PI no 234443.rar (contains "Cheque against PI no 234443.exe")

NanoCore RAT C2:
gahenyt.myddns.me:6702

Intelligence

File Origin

# of uploads :

# of downloads :

168

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Cheque against PI no 234443.exe

Verdict:

Malicious activity

Analysis date:

2021-02-09 12:17:18 UTC

Tags:

rat nanocore

Link:

https://app.any.run/tasks/e552a8e4-ac40-4ae6-9159-e22a31b4ac31

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/116178/

Detection(s):

SecuriteInfo.com.Trojan.Packed2.42841.30270.28601.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

DNS request

Sending a custom TCP request

Creating a window

Running batch commands

Launching a process

Creating a file in the %temp% directory

Creating a file in the %AppData% directory

Creating a process from a recently created file

Creating a file

Sending a UDP request

Creating a file in the %AppData% subdirectories

Creating a file in the Program Files subdirectories

Deleting a recently created file

Connection attempt

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a recently created process

Unauthorized injection to a recently created process by context flags manipulation

Enabling autorun by creating a file

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1487f4e41d24b3440b5d87ca47a899f799f831824bd4d6dd8bb506637157a8ec/

Threat name:

ByteCode-MSIL.Trojan.AgentTesla

Status:

Malicious

First seen:

2021-02-09 10:16:10 UTC

AV detection:

21 of 29 (72.41%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=csd7jza5eszuic25q7fepkez66m7qmmcjpknnxmlwudgg4kxvdwa._file

Verdict:

unknown

NanoCore

79f18eeef7d281b11f7e030d770b3c3fa0e7c595c61e4642e99c4eecd72c6c4e

NanoCore

b320affd7845fa88848b8143b7d3884162c3c7d653547b92e61826c90720dfcd

NanoCore

d44ab027fea1af8575d4e42667e1021bf1cfbf2e7a56b7cd7e26a605d5720b16

NanoCore

Result

Malware family:

nanocore

Score:

10/10

Tags:

family:nanocore evasion keylogger persistence ransomware spyware stealer trojan

Link:

https://tria.ge/reports/210209-gj48qx7k9n/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious use of SetThreadContext

Adds Run key to start application

Checks whether UAC is enabled

Loads dropped DLL

Executes dropped EXE

NanoCore

Malware Config

C2 Extraction:

gahenyt.myddns.me:6702
127.0.0.1:6702

Unpacked files

SH256 hash:

1487f4e41d24b3440b5d87ca47a899f799f831824bd4d6dd8bb506637157a8ec

MD5 hash:

b82a2c603292c4643e5b63e1337a3ae8

SHA1 hash:

4bddf8318b27fb3a6d60da7f323e8456cc423da5

Link:

https://www.unpac.me/results/0b35db59-dde3-4c48-8bd4-a46cc8ca0fe6/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.35

Link:

https://yomi.yoroi.company/submissions/1487f4e41d24b3440b5d87ca47a899f799f831824bd4d6dd8bb506637157a8ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	nanocore_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/