MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 34acd51df743b093c9eda93ebf46db0095fe2bdd4ee58d18c65e8914790f337d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 34acd51df743b093c9eda93ebf46db0095fe2bdd4ee58d18c65e8914790f337d
SHA3-384 hash: 852d03704e48346331240892100c59eb00130733e924bd3b01cc14daf8c9d3b44ec847b0f791a558b526c2157db6ae4b
SHA1 hash: d4770ddfa3bff74a0b9c00d6acecc87d60212fe1
MD5 hash: f76bc0e1dd77808d3668b3a169155dec
humanhash: sink-monkey-oklahoma-eleven
File name:f76bc0e1dd77808d3668b3a169155dec.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:13'312 bytes
First seen:2021-10-11 08:20:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 192:nDCvN8saQ7yVjRnpx5D/2AV3MGkPzr91+QqMT0U2/JT0JN7KaeLqc:nDC18sd7ejRpxZ13M9HH5nT0UUKN7Km
Threatray 4 similar samples on MalwareBazaar
TLSH T13F522A52638C87B9C5768B7ABC77E6400631E73B9CA25F6F188A502E5DD33081763B2D
File icon (PE):PE icon
dhash icon 9ee5656565a5a585 (14 x NanoCore, 11 x XpertRAT, 5 x SnakeKeylogger)
Reporter abuse_ch
Tags:exe NanoCore

Intelligence

File Origin
# of uploads :
1
# of downloads :
178
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f76bc0e1dd77808d3668b3a169155dec.exe
Verdict:
Malicious activity
Analysis date:
2021-10-11 09:08:36 UTC
Tags:
rat nanocore
Link:
https://app.any.run/tasks/563bba01-bac6-41bc-8e68-87a4af8ca299

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/196535/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader43.41196.16623.16473.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a service
Creating a window
Connection attempt to an infection source
Sending a TCP request to an infection source
Launching a process
Creating a file in the %temp% directory
Query of malicious DNS domain
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
75%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6163f3f39fb4d8593d6158b2/reports/15a4de49-2ca6-409f-84bc-1a489c3ba81a/overview
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/868085
Signature
.NET source code contains potential unpacker
Allocates memory in foreign processes
Detected Nanocore Rat
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 500510 Sample: FYrMKmDjFi.exe Startdate: 12/10/2021 Architecture: WINDOWS Score: 100 62 Malicious sample detected (through community Yara rule) 2->62 64 Multi AV Scanner detection for submitted file 2->64 66 Sigma detected: NanoCore 2->66 68 5 other signatures 2->68 8 FYrMKmDjFi.exe 15 5 2->8         started        13 dhcpmon.exe 14 5 2->13         started        15 dhcpmon.exe 2->15         started        17 FYrMKmDjFi.exe 2 2->17         started        process3 dnsIp4 60 store2.gofile.io 31.14.69.10, 443, 49746, 49748 LINKER-ASFR Virgin Islands (BRITISH) 8->60 46 C:\Users\user\AppData\...\FYrMKmDjFi.exe, PE32 8->46 dropped 48 C:\Users\...\FYrMKmDjFi.exe:Zone.Identifier, ASCII 8->48 dropped 50 C:\Users\user\AppData\...\FYrMKmDjFi.exe.log, ASCII 8->50 dropped 76 Writes to foreign memory regions 8->76 78 Allocates memory in foreign processes 8->78 80 Injects a PE file into a foreign processes 8->80 19 FYrMKmDjFi.exe 1 12 8->19         started        52 C:\Users\user\AppData\Local\...\dhcpmon.exe, PE32 13->52 dropped 54 C:\Users\user\...\dhcpmon.exe:Zone.Identifier, ASCII 13->54 dropped 24 dhcpmon.exe 13->24         started        26 dhcpmon.exe 15->26         started        28 FYrMKmDjFi.exe 2 17->28         started        file5 signatures6 process7 dnsIp8 56 cloudhost.myfirewall.org 91.121.250.249, 5654 OVHFR France 19->56 58 192.168.2.1 unknown unknown 19->58 38 C:\Program Files (x86)\...\dhcpmon.exe, PE32 19->38 dropped 40 C:\Users\user\AppData\Roaming\...\run.dat, data 19->40 dropped 42 C:\Users\user\AppData\Local\Temp\tmp563.tmp, XML 19->42 dropped 44 C:\...\dhcpmon.exe:Zone.Identifier, ASCII 19->44 dropped 70 Machine Learning detection for dropped file 19->70 72 Uses schtasks.exe or at.exe to add and modify task schedules 19->72 74 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->74 30 schtasks.exe 1 19->30         started        32 schtasks.exe 1 19->32         started        file9 signatures10 process11 process12 34 conhost.exe 30->34         started        36 conhost.exe 32->36         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/34acd51df743b093c9eda93ebf46db0095fe2bdd4ee58d18c65e8914790f337d/
Verdict:
malicious
Similar samples:
185b9c602b6bb5a090f8f082d5078dc39c43edd4d7bef6a5a632cf56fae99970
NanoCore
1c24e330df208d9678408ff3ca176344afa46eedad2615199969751bd2fdb111
NanoCore
bd5c24761ed0f7e6b1741abc9812e18794dd98524a7f4d3a8998d9a71af071ad
NanoCore
d22ede1d60a87832a0460c17ae961c5dcd9be9a706827435bc1f1eb5b045401d
NanoCore
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/211011-j81dssgfc5/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
cloudhost.myfirewall.org:5654
Unpacked files
SH256 hash:
34acd51df743b093c9eda93ebf46db0095fe2bdd4ee58d18c65e8914790f337d
MD5 hash:
f76bc0e1dd77808d3668b3a169155dec
SHA1 hash:
d4770ddfa3bff74a0b9c00d6acecc87d60212fe1
Link:
https://www.unpac.me/results/9b9a906e-39d3-4f48-a13b-37d7d617a6ad/
Malware family:
NanoCore
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/34acd51df743/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/34acd51df743b093c9eda93ebf46db0095fe2bdd4ee58d18c65e8914790f337d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NanoCore

Executable exe 34acd51df743b093c9eda93ebf46db0095fe2bdd4ee58d18c65e8914790f337d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1649278/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/1635441/
Cape
Cape
https://www.capesandbox.com/analysis/196535/

Comments