MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a51dc72b480d943f292ef6137a3d864ac85fec1d59632c52d12636b7285bee9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2a51dc72b480d943f292ef6137a3d864ac85fec1d59632c52d12636b7285bee9
SHA3-384 hash: 90fed14301d417b7326c7da7db9ff8c6ca10f6e4506e7c8cc45f6fd345c4efe5add4f6c54f548d95ef33e34bc2fef495
SHA1 hash: 2dad34bb6012098ded9ad82a792dcaf338fcde45
MD5 hash: f1c2c21ef5ae1f6eb431800b21f60cb5
humanhash: lithium-single-ohio-nebraska
File name:Product Needed.scr
Download: download sample
Signature NanoCore
Create hunting rule
File size:888'320 bytes
First seen:2020-05-25 08:46:51 UTC
Last seen:2020-05-25 10:17:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 94127ecd07060b70a59da9daa8009625 (3 x Loki, 3 x NanoCore, 3 x AgentTesla)
ssdeep 12288:V2Zq148Ejvc94vSStfq6e0837Xjhj+iwCA8TJbHxnzTFRb7jjVauPJLvLJcx2iCz:4cgUVWFB8hjGChbRnP9aolS9CSm
Threatray 3'338 similar samples on MalwareBazaar
TLSH 9015CF72A2D03872C066113EDF0B55B8DC157D222A746CF72BD8DF0D5E2928161EB7AB
Reporter abuse_ch
Tags:NanoCore RAT scr


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: mail-40132.protonmail.ch
Sending IP: 185.70.40.132
From: Jeffpezoz770 <Jeffpezoz770@protonmail.com>
Reply-To: Jeffpezoz770 <Jeffpezoz770@protonmail.com>
Subject: Re: product catalog
Attachment: Product Needed.z (contains "Product Needed.scr")

NanoCore RAT C2s:
latestspyhostincsub.hopto.org:62830 (129.56.27.198)
alilatestspyhost.ddns.net:62830 (129.56.27.198)

Intelligence

File Origin
# of uploads :
2
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 09:36:08 UTC
File Type:
PE (Exe)
Extracted files:
295
AV detection:
33 of 48 (68.75%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
564934829b321a0cc1fbf18ec4ca452cb90ff0d5a35b57ca1fecf59a23ee660b
NanoCore
5b3e436dde61073e23c45d375871695ef28011d2436cf3ad6ec69ffd9f324e76
NanoCore
5fb13ec9aec5b17f482da9aa1b4843d58721d0c99090e9f6cb3a88940666cc61
NanoCore
6979a4bd390d6bf55225b6b4e5136a633502273812e1be5269e06318f778100a
NanoCore
72182475544d3b228d94d5e9185b7162fe647201b2302c214a00d36a131c2f68
NanoCore
9049b1380346378574ae2f10adbd13a6793639b5375553bb75e4e1874e2613c0
NanoCore
d4d803a83e2c4c348972b6b8e5fce93416b0c60977a447818f592795505fdff1
NanoCore
dbbaf0499e544e3832699110f71f62a521ec93cc8a74656c92af7023f554d897
NanoCore
eddb02f1d6ecdcfb30630930e91c51d05d71e18b348c4e3ef2f6a84d2895ba6d
NanoCore
f7c15b22bb99bfb56eabcd9b8c985c15c5d9ed341303b39362dccb6808a6a498
NanoCore
+ 3'328 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger persistence spyware stealer trojan upx
Link:
https://tria.ge/reports/201109-4cgdpam5sa/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
UPX packed file
NanoCore
Malware Config
C2 Extraction:
latestspyhostincsub.hopto.org:62830
alilatestspyhost.ddns.net:62830
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

z d8ae438c72ffdbd7bfbabf6dbb6bd5d82402654dab91e993e852b2bfa49d7a6d

NanoCore

Executable exe 2a51dc72b480d943f292ef6137a3d864ac85fec1d59632c52d12636b7285bee9

(this sample)

  
Dropped by
MD5 0cb2a78ae0200fa3fb4d49ef3f694595
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 d8ae438c72ffdbd7bfbabf6dbb6bd5d82402654dab91e993e852b2bfa49d7a6d

Comments