MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1faba4e3aa2465396894cc4b71f97f0b50c593245bd03421db8e4e996e9c3159. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1faba4e3aa2465396894cc4b71f97f0b50c593245bd03421db8e4e996e9c3159
SHA3-384 hash: 87666185fcadbe3976df0bde6fca4088fc573b2148734f1fed4aa8484006bb2129056523fafa5266194b48bb788bbab0
SHA1 hash: b79e2b0151b24c2135947a176390df2938c7ba42
MD5 hash: 2366eb7e94fe095e52cf3961acd15934
humanhash: carolina-may-romeo-blue
File name:PO.pdf.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:736'256 bytes
First seen:2020-04-21 08:53:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash aa88a033e640f5e2cd9ec14c2ef177fc (1 x NanoCore, 1 x AgentTesla, 1 x Loki)
ssdeep 12288:leHavhRELfTHxWrYsr2xQon7PByGpRyDD/WZCKiklQH9Z+nrOZCEb4EObnmdaSbo:COMb3dnjMCEeZOEQf+nrOZCkiredE
Threatray 2'463 similar samples on MalwareBazaar
TLSH 9DF4CF27F6B09837C12226BD5D4B5768A83ABE112D2D26472FF81D4C9F397C2385B187
Reporter jarumlus
Tags:NanoCore

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.Herz.B.11935.22885.UNOFFICIAL
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-04-21 09:46:00 UTC
File Type:
PE (Exe)
Extracted files:
30
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=d6v2jy5kersts2euzrfxd6l7bnimlezelpidiio3rzhjs3u4gfmq._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
24fe76a4e6cd5623f2326d2f43de09b9b6f4de236e80ea5aca50b76da888c0af
NanoCore
3e8fda53d335f929c539e5fbc47a79e166ecbfda4752c50544c429a199056c62
NanoCore
68101d145825fc980210f1f56638011d98eeaf5c53fb734b62a80dac6489f2e3
NanoCore
75f0a0c09c70fb729182f35452ce0dc8bfcdb9aa626b228cd05c832647d2b058
NanoCore
90474a0270106b33e3208a63041d2e4d013b1d2b415bf3bf44e9a5ab685d0531
NanoCore
a4d6c0a909365bd89fdf812fbb75f92edc06fcd2a9a7b3c6d9b553ffe124858f
NanoCore
aee0158a9f836306b64e6c99e732073aa81fe23944c91a3d0fcf9a92508019ec
NanoCore
c18ae57203cb03daa5d28d11862951854656f2ce1f7d74237d3972345e7140ad
NanoCore
e1bf95bd96a59075ac24eec7c47b3142361ea79c1fb68e2b6039212fba523449
NanoCore
fd54073286010523ef59ce428c3ae8b92f87abce1027ed232befe46499bf5e53
NanoCore
+ 2'453 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and Threadskernel32.dll::CloseHandle
kernel32.dll::CreateThread
WIN_BASE_APIUses Win Base APIkernel32.dll::LoadLibraryExA
kernel32.dll::LoadLibraryA
kernel32.dll::GetSystemInfo
kernel32.dll::GetStartupInfoA
kernel32.dll::GetDiskFreeSpaceA
kernel32.dll::GetCommandLineA
WIN_BASE_IO_APICan Create Fileskernel32.dll::CreateFileA
kernel32.dll::DeleteFileA
kernel32.dll::FindFirstFileA
kernel32.dll::GetTempPathA
version.dll::GetFileVersionInfoSizeA
version.dll::GetFileVersionInfoA
WIN_REG_APICan Manipulate Windows Registryadvapi32.dll::RegOpenKeyExA
advapi32.dll::RegQueryValueExA
WIN_USER_APIPerforms GUI Actionsuser32.dll::ActivateKeyboardLayout
user32.dll::CreateMenu
user32.dll::FindWindowA
user32.dll::PeekMessageA
user32.dll::CreateWindowExA

Comments