MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24bbbef09b9e58d6da0fe8ae7dbfbc093dc5287cb26dc98e948684a1fc442642. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24bbbef09b9e58d6da0fe8ae7dbfbc093dc5287cb26dc98e948684a1fc442642
SHA3-384 hash: 034cd2c2ae7776f9c31915fd3cab354edec74c4e595fe97eb4a2f3f99f9f54d3f2d75b31a65c6f76efd076c5e865e0a8
SHA1 hash: 23120ba30158b84527ead4d8a9861f5e4d4c90fb
MD5 hash: 8b7141743d16877e4680cb695cfc4a06
humanhash: harry-two-don-venus
File name:ALCAZAREN_SA,pdf.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:477'184 bytes
First seen:2020-07-16 19:13:56 UTC
Last seen:2020-07-16 20:13:25 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:nvtUeeeeeeeeeeeeeeeU2k4zUEXoD/VFszKE9zpyx1g0Kst:nVUeeeeeeeeeeeeeeeYD9uLugst
Threatray 1'127 similar samples on MalwareBazaar
TLSH 87A425D829218142D59F3DF0BD5DDA3022A23E9FF7F0624967D2BE1FB1B3212D14661A
Reporter abuse_ch
Tags:exe NanoCore nVpn RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: dante.webhosting.it
Sending IP: 178.162.199.43
From: Omar Gongora <info@alcazaren.com.gt>
Subject: Offer Request
Attachment: ALCAZAREN_SA,pdf.zip (contains "ALCAZAREN_SA,pdf.exe")

NanoCore RAT C2:
billionaire.ddns.net:3734 (79.134.225.122)

Pointing to nVpn:

% Information related to '79.134.225.0 - 79.134.225.127'

% Abuse contact for '79.134.225.0 - 79.134.225.127' is 'abuse@privacyfirst.sh'

inetnum: 79.134.225.0 - 79.134.225.127
netname: PRIVACYFIRST-EU
country: EU
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
status: ASSIGNED PA
mnt-by: AF15-MNT
org: ORG-TPP6-RIPE
created: 2020-07-14T15:26:02Z
last-modified: 2020-07-14T15:31:06Z
source: RIPE

Intelligence

File Origin
# of uploads :
2
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/27051/
Detection(s):
SecuriteInfo.com.CAP_HookExKeylogger.13294.31899.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/388846
Signature
.NET source code contains potential unpacker
Detected Nanocore Rat
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 246607 Sample: ALCAZAREN_SA,pdf.exe Startdate: 18/07/2020 Architecture: WINDOWS Score: 100 37 billionaire.ddns.net 2->37 43 Multi AV Scanner detection for domain / URL 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 9 other signatures 2->49 9 ALCAZAREN_SA,pdf.exe 5 2->9         started        12 MSBuild.exe 2 2->12         started        signatures3 process4 file5 29 C:\Users\user\AppData\Roaming\XxjroH.exe, PE32 9->29 dropped 31 C:\Users\user\AppData\Local\...\tmp8797.tmp, XML 9->31 dropped 33 C:\Users\user\...\ALCAZAREN_SA,pdf.exe.log, ASCII 9->33 dropped 14 MSBuild.exe 8 9->14         started        19 schtasks.exe 1 9->19         started        21 conhost.exe 12->21         started        process6 dnsIp7 39 billionaire.ddns.net 79.134.225.122, 3734, 49722, 49723 FINK-TELECOM-SERVICESCH Switzerland 14->39 35 C:\Users\user\AppData\Roaming\...\run.dat, Non-ISO 14->35 dropped 41 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->41 23 schtasks.exe 1 14->23         started        25 conhost.exe 19->25         started        file8 signatures9 process10 process11 27 conhost.exe 23->27         started       
Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/24bbbef09b9e58d6da0fe8ae7dbfbc093dc5287cb26dc98e948684a1fc442642/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2020-07-16 19:04:18 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=es5354e3tzmnnwqp5cxh3p54be64kkd4wjw4tduuq2ckd7ceezba._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
016e3777c66eb1d3ebc04c573a0b9f9dca639d32312b87e68d84934b13e02a9c
NanoCore
0d6824a76cdb66150361c039b10e1fe5eb109b7bf6131f825186f537b5d8e497
NanoCore
2198d9c0cafd92002671af04dc5ba8a90abdf87ceb4ea3877b128857a193c8b8
NanoCore
3d0fc511748582c4c2d6a1e46d10f1fe8116803ab7400d571e43997fb1f23201
NanoCore
753688c06533ff22d08293f57122f3643401e828aa4766887951093de3239b83
NanoCore
9b6b2038805b770162eb920f87e9ca06742f72d7b2034883c9b90d41e0c06e93
NanoCore
9bca8f7366390a1fac5bfcc29896ce8d4e75475eb9a3b41af7293e9c6b718451
NanoCore
bcdf903e15833b193349df7405af34e9b48a943c703d3ce222d82911e6e7d6f8
NanoCore
dee1fa115a3e06310b958baca7bf709144f770de027ab3c615f6937b7544cd75
NanoCore
ee180e2ce4c79e38d7c5c4f5e56fd22642d8fefa00cc543e9d85dbcb6944ae88
NanoCore
+ 1'117 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
evasion trojan keylogger stealer spyware family:nanocore
Link:
https://tria.ge/reports/200716-ct2sbej29x/
Behaviour
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Creates scheduled task(s)
Suspicious use of SetThreadContext
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
billionaire.ddns.net:3734
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:CAP_HookExKeylogger
Create hunting rule
Author:Brian C. Bell -- @biebsmalwareguy
Reference:https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

zip 56a4c2d4dcb02b86c7b3e1446e5c5d1d72fbfd87ef5ff02045e80586cba54588

NanoCore

Executable exe 24bbbef09b9e58d6da0fe8ae7dbfbc093dc5287cb26dc98e948684a1fc442642

(this sample)

  
Dropped by
MD5 1b68f8b456c791d4d5447193a1a15ab8
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 56a4c2d4dcb02b86c7b3e1446e5c5d1d72fbfd87ef5ff02045e80586cba54588
Cape
Cape
https://www.capesandbox.com/analysis/27051/

Comments