MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28a44d1e835114aaab990d3319db3292b543a81a271903d06dc2eaad9b2bc793. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28a44d1e835114aaab990d3319db3292b543a81a271903d06dc2eaad9b2bc793
SHA3-384 hash: 02ff595aa16ab4ad71079a3457a2f254eeef364612d0e7aa2ba7b20c021268fa35dd2c0f3e44f5cd02e3b87380b0258a
SHA1 hash: eefe878044d88dd4983c3d4fc47acb3d58311398
MD5 hash: 394f57988bfdef55d0c66998bec581de
humanhash: princess-jupiter-oven-aspen
File name:Swift copy 16-2019.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:542'208 bytes
First seen:2020-04-16 14:24:18 UTC
Last seen:2020-04-16 15:01:35 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'653 x AgentTesla, 19'464 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:kTgiqlYVUjcCudKiUmFQ3C/o4m/Yz3l/Kf:k+cC4PS3Cw4yY7NG
Threatray 1'419 similar samples on MalwareBazaar
TLSH 92B4F87EAA586B2BF73D91F889430149F4B441EB26325CCB86C7328D34599017BEE36D
Reporter James_inthe_box
Tags:exe NanoCore

Intelligence

File Origin
# of uploads :
2
# of downloads :
93
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.PackedNET.278.27671.30269.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Nanocore
Create hunting rule
Status:
Malicious
First seen:
2020-04-16 10:16:52 UTC
File Type:
PE (.Net Exe)
Extracted files:
5
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fcse2hudkekkvk4zbuzrtwzssk2uhka2e4mqhudnylvk3gzly6jq._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
1faba4e3aa2465396894cc4b71f97f0b50c593245bd03421db8e4e996e9c3159
NanoCore
4f5bf279812fb7f1276a7ce23071b23b6c9fc38938d52b846f060087285bdb41
NanoCore
68101d145825fc980210f1f56638011d98eeaf5c53fb734b62a80dac6489f2e3
NanoCore
6839dfb2bf232ccc68bdb4e275ffc1a2e8eb4c672071b706cd3e7a77c85cd4e3
NanoCore
7e6dc9928e049d75cd726d8542b39cf46afef0cfd37c8dcb968ea618aedbb696
NanoCore
80a005192219c57b12ff163bc538c299f8f5a0c548c680c6119fe11e2a1ac28a
NanoCore
90474a0270106b33e3208a63041d2e4d013b1d2b415bf3bf44e9a5ab685d0531
NanoCore
a2966a3e5a7753ea245a9e5228cf96d631e15a3777a5b2550724bed0f646784a
NanoCore
b269ac01ba383c1e9a7311cdb2af843167b3a5652d8b0791f7d61ce636a439c3
NanoCore
ca2e54b05185ed7f76ba5ccf9f24a2e607a6322fdbd1acbc37902e4dac015697
NanoCore
+ 1'409 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments