MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37dbfcfd7e663b2c10f51ef49205ad1a8c1c0003261d45e6ac196b0c8d30dd28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 37dbfcfd7e663b2c10f51ef49205ad1a8c1c0003261d45e6ac196b0c8d30dd28
SHA3-384 hash: cb564a8fedc00c5c20b11fb9c5d6eb32734e100c0daa59f100ff68a4ad60f3e7e0292158e21558e8504f1c8f1c6fe760
SHA1 hash: b3b456fcce6a7c22743c7094c0ba5417e8cc18c0
MD5 hash: 794e3dc084d9ebb202ff71e1e8b14b6d
humanhash: twelve-dakota-asparagus-nevada
File name:PDF.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:605'184 bytes
First seen:2020-04-30 12:20:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'608 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:YU3NBeTRXWxQzW6ghnBbJfdqRNHt5AfC8xs/PhUhfL6cZLqbB9JoskagLaE4MFux:/NBIXcQEr1oHtLb
Threatray 1'376 similar samples on MalwareBazaar
TLSH ACD46C5C369470DFD467DA72DEA42C60EA65B877A30FC207A013229D9E6DA87DF101F2
Reporter abuse_ch
Tags:exe geo GRC NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: dharmajaya.co.id
Sending IP: 103.113.170.147
From: Ελληνική Αστυνομία <fraud.invitations@astynomia.gr>
Subject: Έρευνα για την απάτη της ελληνικής αστυνομίας
Attachment: PDF.iso (contains "PDF.exe")

NanoCore RAT C2:
172.111.188.199:8829

Intelligence

File Origin
# of uploads :
1
# of downloads :
94
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-04-30 12:37:02 UTC
File Type:
PE (.Net Exe)
Extracted files:
11
AV detection:
23 of 31 (74.19%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=g7n7z7l6my5syehvd32jebnndkgbyaadeyoulzvmdfvqzdjq3uua._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
25b25b12d4f4645124f44ef05b685d011b3705d0a24e9ce45ab74a885b360491
NanoCore
286add28a79440668077a7d762ee81ee169f1c08daa27bc680dbf8c8832d2785
NanoCore
31183ca60a0863d3a98c1e5c21eadb725e7d335dbf176eaf53b5a22cfad18fd4
NanoCore
92632fa88b730e2593837c7d51884384dcf8c887fd4b8d3cc6741d12ae9cd347
NanoCore
a2f6de0a1378b3bc2daea1d1b1b8f5dbe17f34d09492e2305c3cb7aa0f427e87
NanoCore
bff01aac6b9a397cde60705d94e6b753e8d4c388ac18c7b7dc75246f67e856c5
NanoCore
c068b1a7379f95ee883cd4ed9639bb2b28c380934f3bc0e0c7be97ad808c7b8a
NanoCore
ca2e54b05185ed7f76ba5ccf9f24a2e607a6322fdbd1acbc37902e4dac015697
NanoCore
d65078d44a7d78102d1ed83379ea720bd231cfee09ef55a75075dca201b63df0
NanoCore
fcfc827205cd38cdf997f72b1d58eba51ac12da6ba5939279b626522b11fd938
NanoCore
+ 1'366 additional samples on MalwareBazaar
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

cc51e76962f1d392ae6434dee91c73a7

NanoCore

Executable exe 37dbfcfd7e663b2c10f51ef49205ad1a8c1c0003261d45e6ac196b0c8d30dd28

(this sample)

  
Dropped by
MD5 cc51e76962f1d392ae6434dee91c73a7
  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments