MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ce7c17d53cb526c0e11f8d6b24d7316a42a98a355bd16a0b17cc11d62114cec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	1ce7c17d53cb526c0e11f8d6b24d7316a42a98a355bd16a0b17cc11d62114cec
SHA3-384 hash:	824f7df806f21d2a4ff9e95a532a6c0610a7109a2edb06b184dd6517db7a28d5d394c5689a9cc9dcb9f507a6174936f9
SHA1 hash:	5f943f34e7383fbde84791a5ef8fc2395cf51ff9
MD5 hash:	1b998a5d3bd35ba0f5cdf9ca86f6a3bd
humanhash:	triple-papa-venus-seven
File name:	Tender Documents LH22000309AA2022___Pdf.iso
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	737'280 bytes
First seen:	2022-06-09 13:37:20 UTC
Last seen:	Never
File type:	iso
MIME type:	application/x-iso9660-image
ssdeep	12288:XI9q3WkGypQkKkryHfTyv1ILAhvD5GfruH+xhqS6K:XIOWkGWyu9kUd0Uu
TLSH	T102F4E1F5EEF97CA1E01821377494603C33E65E4ADC66992AF28FE20A37527C254E4E17
TrID	99.6% (.NULL) null bytes (2048000/1) 0.2% (.ATN) Photoshop Action (5007/6/1) 0.0% (.BIN/MACBIN) MacBinary 1 (1033/5) 0.0% (.ABR) Adobe PhotoShop Brush (1002/3) 0.0% (.SMT) Memo File Apollo Database Engine (88/84)
Reporter	cocaman
Tags:	iso NanoCore QUOTATION

cocaman

Malicious email (T1566.001)
From: "Naveen Tender Coordinator. <salestenders@abcondubai.com>" (likely spoofed)
Received: "from abcondubai.com (unknown [103.125.190.179]) "
Date: "9 Jun 2022 04:50:09 -0700"
Subject: "INVITATION FOR QUOTATION-Spec of products -LH/22/000309/AA/2022"
Attachment: "Tender Documents LH22000309AA2022___Pdf.iso"

Intelligence

File Origin

# of uploads :

# of downloads :

302

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Iso_badexts83.UNOFFICIAL

SecuriteInfo.com.W32.AIDetectNet.01.744.15944.UNOFFICIAL

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/62a1f7d95dc88d35716f2045/reports/94563234-bc85-436c-8120-bd0eab7fba2f/overview

Result

Verdict:

MALICIOUS

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1ce7c17d53cb526c0e11f8d6b24d7316a42a98a355bd16a0b17cc11d62114cec/

Threat name:

ByteCode-MSIL.Trojan.RealProtect

Status:

Malicious

First seen:

2022-06-09 03:37:21 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

18 of 39 (46.15%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=dtt4c7ktznjgydqr7dlletltc2scvgfdkw6rnifrptar2yqrjtwa._file

Result

Malware family:

nanocore

Score:

10/10

Tags:

family:nanocore evasion keylogger spyware stealer suricata trojan

Link:

https://tria.ge/reports/220609-qxdh8agfaq/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Checks whether UAC is enabled

NanoCore

suricata: ET MALWARE Possible NanoCore C2 60B

Malware Config

C2 Extraction:

oluwaboysharp.ddns.net:7090

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1ce7c17d53cb526c0e11f8d6b24d7316a42a98a355bd16a0b17cc11d62114cec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SUSP_EXE_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:	Internal Research