MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20b2ed045a7ca6f08c7ced5be5964eb68d3e39733b9e5fcf57d65e7950ebfe0f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 19


Intelligence 19 IOCs YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 20b2ed045a7ca6f08c7ced5be5964eb68d3e39733b9e5fcf57d65e7950ebfe0f
SHA3-384 hash: 44b7b48b2dd4a11cce92b7e545f4da784feb2a2d74aad3825a6cd91a7080b3b6f59669a7eb4a2bad454c785709851187
SHA1 hash: d58e4b2f8dda6f5b3e831383773de1a5195cdeb1
MD5 hash: 4c0c5481ec40235ad91fe6e8492c2d46
humanhash: asparagus-sodium-social-vermont
File name:16988555454d794181e0e1fed734f20c841575956ffc53e9e10d28072eb740c807aaa0f8e0833.dat-decoded
Download: download sample
Signature NanoCore
Create hunting rule
File size:207'360 bytes
First seen:2023-11-01 16:19:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'648 x AgentTesla, 19'452 x Formbook, 12'201 x SnakeKeylogger)
ssdeep 6144:QLV6Bta6dtJmakIM5V6xUtdHfBTQxVqtjrez:QLV6BtpmkPkd/FcVqxe
Threatray 1'475 similar samples on MalwareBazaar
TLSH T10914BE5637B8492FE2DE86B9611242479379C2E3ACC3F3DE28D850B75B267E506071E3
TrID 67.7% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
9.7% (.EXE) Win64 Executable (generic) (10523/12/4)
6.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
4.1% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter abuse_ch
Tags:base64-decoded exe NanoCore


Avatar
abuse_ch
Malware dropped as base64 encoded payload

Intelligence

File Origin
# of uploads :
1
# of downloads :
379
Origin country :
DE DE
Vendor Threat Intelligence
Malware family:
nanocore
Create hunting rule
ID:
1
File name:
16988555454d794181e0e1fed734f20c841575956ffc53e9e10d28072eb740c807aaa0f8e0833.dat-decoded
Verdict:
Malicious activity
Analysis date:
2023-11-01 18:50:15 UTC
Tags:
nanocore
Link:
https://app.any.run/tasks/c63d47f5-21cc-420e-b871-676eb21d9066

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/457660/
Detection(s):
Win.Trojan.NanoCore-9852758-0
Create hunting rule

Win.Packed.Generic-9777790-0
Create hunting rule

Win.Trojan.Generic-9783914-0
Create hunting rule

Win.Dropper.Nancrat-9869495-0
Create hunting rule

Win.Dropper.Nanocore-9916514-0
Create hunting rule

Win.Trojan.Nanocore-5
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Creating a file in the %AppData% subdirectories
Creating a file in the Program Files subdirectories
Searching for synchronization primitives
DNS request
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
eazfuscator lolbin nanocore obfuscated packed packed rat remote schtasks
Link:
https://www.filescan.io/uploads/65427abbbc703e36b096faa1/reports/230bd4bc-6b25-4821-aa79-3d240b5e5ee4/overview
Verdict:
Malicious
Labled as:
Backdoor.MSIL.Agent
Link:
https://www.hybrid-analysis.com/sample/20b2ed045a7ca6f08c7ced5be5964eb68d3e39733b9e5fcf57d65e7950ebfe0f
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
NanoCoreRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f6b3d298-e0de-4d4e-991d-79cd66bbbe46
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1335580
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Detected Nanocore Rat
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Uses dynamic DNS services
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/20b2ed045a7ca6f08c7ced5be5964eb68d3e39733b9e5fcf57d65e7950ebfe0f
Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/20b2ed045a7ca6f08c7ced5be5964eb68d3e39733b9e5fcf57d65e7950ebfe0f/
Threat name:
ByteCode-MSIL.Backdoor.NanoCore
Create hunting rule
Status:
Malicious
First seen:
2023-11-01 16:20:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
1
AV detection:
24 of 24 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eczo2bc2pstpbdd45vn6lfsow2gt4olthopf7t2x2zphsuhl7yhq._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
15f43e7843401484c486ddcfcf8119d2cd0f29f2e99017f4c96c83e530a91b17
NanoCore
6056ddf4fd5f58f421883da0176a32cbad5458c80d33e1e0d4f1ddcf28f6d21d
NanoCore
6fe55b655fc4cd3b51c813e38df4416675ae81ab0cd303e15f591fd74846f9de
NanoCore
71d8447b0d646903db508314cdc59708855c914ec4a3a72d7f06f487177e11fc
NanoCore
84143a9050c55b6467062bd75f5f10f826b9b1107f7e96e7838122b33547c844
NanoCore
b517d5a439ae92d7470dcf9595b0069dd0a18a4933fe13ae6571bea0fcb9a254
NanoCore
b799a7a8d2744eed52b8c8ae4515ec1c6d3363a717572daef2cdf9eaad459106
NanoCore
dfb9b3c7cf15baa877da2d2c87e1e53761517094bab2de1a6b92ebca122fa858
NanoCore
e844192fb4c52758db729e18e8898fe0921bdbe1e2d3ac3da6a6b5d2cedecb71
NanoCore
+ 1'465 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/231101-ts4rdsca76/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Drops file in Program Files directory
Adds Run key to start application
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
segun.ddns.net:7006
Unpacked files
SH256 hash:
20b2ed045a7ca6f08c7ced5be5964eb68d3e39733b9e5fcf57d65e7950ebfe0f
MD5 hash:
4c0c5481ec40235ad91fe6e8492c2d46
SHA1 hash:
d58e4b2f8dda6f5b3e831383773de1a5195cdeb1
Detections:
win_nanocore_w0
Create hunting rule
Link:
https://www.unpac.me/results/f8856016-439f-464f-acb6-bb46a40f582b/
Malware family:
NanoCore
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/20b2ed045a7c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/20b2ed045a7ca6f08c7ced5be5964eb68d3e39733b9e5fcf57d65e7950ebfe0f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:malware_Nanocore_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:MALWARE_Win_NanoCore
Create hunting rule
Author:ditekSHen
Description:Detects NanoCore
Rule name:nanocore_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Feb18_1_RID2DF1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:Nanocore_RAT_Gen_2_RID2D96
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Windows_Trojan_Nanocore_d8c4e3c5
Create hunting rule
Author:Elastic Security
Rule name:win_nanocore_w0
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

4d794181e0e1fed734f20c841575956ffc53e9e10d28072eb740c807aaa0f8e0

NanoCore

Executable exe 20b2ed045a7ca6f08c7ced5be5964eb68d3e39733b9e5fcf57d65e7950ebfe0f

(this sample)

  
Dropped by
SHA256 4d794181e0e1fed734f20c841575956ffc53e9e10d28072eb740c807aaa0f8e0
  
Dropped by
MD5 3ef1c1b9daff5d792686e0d73b261527
  
URLhaus
https://urlhaus.abuse.ch/url/2726978/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/457660/

Comments