MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d8d0993509c9bf761ec73c65be5dd1c03a416f56dd76973851920deaf9bad76. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 5

Intelligence 5 IOCs YARA 5 File information Comments

SHA256 hash:	2d8d0993509c9bf761ec73c65be5dd1c03a416f56dd76973851920deaf9bad76
SHA3-384 hash:	33cb16948c9bc0ef7442c0173d805f9f74e91cd13b30afef47f22dff9ad1be6bee7d80c7fb62560198954e1fcbd543ac
SHA1 hash:	655447bb3e7b1fcd37aca3db8161be5a2d8e578e
MD5 hash:	84a7b094bc7d7ec3cd3707494dba6d58
humanhash:	nevada-five-two-mississippi
File name:	Outstanding Invoices_pdf.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	404'992 bytes
First seen:	2020-06-29 11:53:55 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'748 x AgentTesla, 19'643 x Formbook, 12'245 x SnakeKeylogger)
ssdeep	12288:4sU7DoFJsuclq7UGAriZh5781NMNLXrqV:OEfsTriZTuMrI
Threatray	1'191 similar samples on MalwareBazaar
TLSH	4584CF9073B9870AE1BE8BF854A011105B7639167A23E75C8DC134EA1DB7BC20B57B7B
Reporter	abuse_ch
Tags:	exe NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: mail.bgesoaeg.ml
Sending IP: 192.227.121.237
From: david@bgesoaeg.ml
Subject: Due Payment Notification 7183544 FX
Attachment: Invoices_QTYD33_of 2020-ASIA CITRA PRATAMA -AIRO 34-20_pdf.gz (contains "Outstanding Invoices_pdf.exe")

NanoCore RAT C2:
79.134.225.114:2072

Hosted on nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/16236/

Detection(s):

SecuriteInfo.com.Fareit-FVR97B1CDB35EA0.28661.UNOFFICIAL

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2d8d0993509c9bf761ec73c65be5dd1c03a416f56dd76973851920deaf9bad76/

Threat name:

ByteCode-MSIL.Infostealer.Fareit

Status:

Malicious

First seen:

2020-06-29 11:55:07 UTC

AV detection:

25 of 31 (80.65%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=fwgqte2qtsn7oypmopdfxzo5dqb2ifxvnxlws44fdeqn5l43vv3a._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

04cd4e603ec3e6042cc9d2b04e3e156f829d3fa0cdf76baf978ec0562116c4a7

NanoCore

08c1ed3585826baa8e470be4c446478a895317380573ef787e53afdc264569e3

NanoCore

4192b46f43ae6f482490aa98fbd0690ff4974c677463c73a4230eaa70106b791

NanoCore

5c12f492a1bc370b4df06dad9f2b5bf8398dcf59e8e7448408feee88bf3c6569

NanoCore

5e9feced3d478c821c45e4378ee06f31ab670b7b3fa23e29d75f9f6b46d41df1

NanoCore

6314fa268e933bd1c708c785212078a767c4ea0c602357002171f8b014d29989

NanoCore

972b4efd2dda4526a8cd4e508a1b62890e1c082380e458555dd1671045327ef9

NanoCore

bffcfa5a0174337b9a565e7880819ec3388eed4dd15a6076e4f99be4ec5d5f19

NanoCore

d86b5f7fffdf4b871b5487b02de0366b3edbd96a75f86a0f57a602796a8136da

NanoCore

+ 1'181 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

keylogger trojan stealer spyware family:nanocore evasion persistence

Link:

https://tria.ge/reports/200629-jyq1c3qet2/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: GetForegroundWindowSpam

Drops file in Program Files directory

Suspicious use of SetThreadContext

Maps connected drives based on registry

Checks whether UAC is enabled

Adds Run entry to start application

Checks BIOS information in registry

Looks for VMWare Tools registry key

Looks for VirtualBox Guest Additions in registry

NanoCore

Malware Config

C2 Extraction:

79.134.225.114:2072
newoffce.duckdns.org:2072

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/