MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cef46cbb22cfda50b0e93dadedfb09f511b80e802d239270c96954a38d11f28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1cef46cbb22cfda50b0e93dadedfb09f511b80e802d239270c96954a38d11f28
SHA3-384 hash: d8090f3937dd118376eff60b92798fdf8ce07c437069d2031e03240d1b2a87e7bdae119faaf499e89618888560d5b729
SHA1 hash: ad0bc2ed9715fdcd1b647da52e2865a1879ac64e
MD5 hash: ebaaf5886c7701636b4a4c6fc8869786
humanhash: red-illinois-vermont-nine
File name:SecuriteInfo.com.Trojan.Nanocore.427.2042.13547
Download: download sample
Signature NanoCore
Create hunting rule
File size:284'928 bytes
First seen:2020-04-25 06:40:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'477 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 6144:UHMu3XdXKGQnIMHDus3KckT5DSt9cTLLUlroGp2tr0A7d8:U4HH9KPBSg3LUlrbkt4A7
Threatray 1'181 similar samples on MalwareBazaar
TLSH 0454020CB7489B52C9BE49B798E356205772DC2B4787F70B3CC872B998327DA858125F
Reporter SecuriteInfoCom
Tags:NanoCore

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Nanocore.427.2042.13547.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-02-26 12:28:21 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
25 of 30 (83.33%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=dtxuns5sft62kcyospnn5x5qt5irxahialjdsjyms2kuuogrd4ua._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
dridex
Create hunting rule
Similar samples:
3261040962bfbb80c604e7f2df4351b3b9b6854ea771f9b9b5677c7ff31e985e
NanoCore
4de20c38ffff3f9d75d9a446f152c017d9010477c28c8b97875f95f448ecb761
NanoCore
6d0f47774a21e610e5fdb8cf53a490e8534aacad7633d67a6919c7687f0ed974
NanoCore
7d29f23903c68f1f80682e28c4b9a9628c74f8e6894147ed54bc21180358f862
NanoCore
9631112f3c105bfd3d00a80f15c76131541c94cbde549e195e754456c5d36cdf
NanoCore
97f67123bf9b506479f14240bb2045a9e5e12062039ad4a60c065232b293ea0c
NanoCore
bcad4484678a90c504a059988419b17853af8249e69b7c6edbd76c7938d8ae07
NanoCore
bf5d5c28bec7bdcf41fad771fd465ba6bb9a56e053c9470a6e10293466109d3c
NanoCore
d7789d465be563d19b1ade313c83023363379649f935e333e16643eec1bc150e
NanoCore
fadcffc72696cb639334be446d2aeb90743b270276f48b730efbb59b73505a85
NanoCore
+ 1'171 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NanoCore

Executable exe 1cef46cbb22cfda50b0e93dadedfb09f511b80e802d239270c96954a38d11f28

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/350972/
  
Delivery method
Distributed via web download

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments