MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b399acbc2227f52d5efa817d7ddff99105d6bb1bd4ddd5f4f6c769d6ed57518. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Worm.Virut


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b399acbc2227f52d5efa817d7ddff99105d6bb1bd4ddd5f4f6c769d6ed57518
SHA3-384 hash: af91e79994a5d61f077291444f50e25edb374168d2b1323bb37a150e7974c730cbed783d4a1fd8d7130959abc380e46d
SHA1 hash: 9dde3de0d0bb411019de834b0be5a5e8f70b7ce5
MD5 hash: 4527ada9482316121f394aad10f89974
humanhash: sad-utah-uncle-california
File name:1b399acbc2227f52d5efa817d7ddff99105d6bb1bd4ddd5f4f6c769d6ed57518
Download: download sample
Signature Worm.Virut
Create hunting rule
File size:581'632 bytes
First seen:2020-06-16 09:33:27 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 6144:DUVfEsKQyAjnpxi2p+8eyLfrl553ng7+RJXhybFV7h1UNPfQOFBMe6HgOj9YRYkq:DEcE3Dp+8emlTNYbSTBMetXFf+Mc+
Threatray 1'085 similar samples on MalwareBazaar
TLSH 9FC4023535D8A863C03C93391D95CCAA3A72FD025BB6D356216AFF1A2A31314EE17BC5
Reporter JAMESWT_WT
Tags:Worm.Virut

Intelligence

File Origin
# of uploads :
1
# of downloads :
119
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/10728/
Gathering data
Threat name:
Win32.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2015-12-14 00:42:00 UTC
File Type:
PE (.Net Exe)
Extracted files:
17
AV detection:
30 of 48 (62.50%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
1064f65ca25e0759b7cebcd985a6243c98ccd08317df9f87dd1c8b88c29e2a9a
Worm.Virut
1583c29f396b51c03866ecbac92dfae57d41c361d8f6f5ae71600a84a4b9033d
Worm.Virut
15c0c580f217bf8fd7f973813900f8abb2c366b833961eb87703dc3f0b20f90b
Worm.Virut
17fa709f1a866d573f997f8f1288d537de382cccc5a4f9c1811db9da34c016b2
Worm.Virut
2273296f635f3e62fab2910123b1cf32832e3b62344a346a8663c2a31f00a98d
Worm.Virut
34f1b02bdccebe61deb518957acd32c9a64ce358102db3be15ed7d46f9945004
Worm.Virut
4329ace3154dca4e544733d0f2f10abc543755dde977d9bb6998fb7368186bb8
Worm.Virut
54f0211463fd813773ab82311eee3104c041b17a37e8c6308457294321d3587a
Worm.Virut
92771caca06fe18551b241f2fd3e8d6f53c29d48d0e879c93c5458d9fabd082b
Worm.Virut
de931e02ce90c509d5dcf1c3d53352809a909410c00796bdfa9f10514a37a627
Worm.Virut
+ 1'075 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
evasion trojan keylogger stealer spyware family:nanocore
Link:
https://tria.ge/reports/200624-ay7njck1bn/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetThreadContext
Checks whether UAC is enabled
NanoCore
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/10728/

Comments