MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38701fe4b63d1436ba2e26cc7e268327299b58bcccbf074bfb2cbbcf57ceb2ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 6


Intelligence 6 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 38701fe4b63d1436ba2e26cc7e268327299b58bcccbf074bfb2cbbcf57ceb2ea
SHA3-384 hash: ca081dd0da97d2a32856061672ec31894237f178e91c738517a9fe0a750f9d791f8ea20b1c3fad40c5440dc06ad385a1
SHA1 hash: a8ed7f1f391552de6e1b47b732f23049aa336ae2
MD5 hash: e2a70ff4849f01d6e1fe57b4ffb46dd1
humanhash: bravo-mango-jersey-illinois
File name:Scan2020-06-17_124920.pdf.scr
Download: download sample
Signature NanoCore
Create hunting rule
File size:1'157'957 bytes
First seen:2020-06-17 10:15:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep 24576:6NA3R5drXdt5A9p9vmtb9c9RV56etGA9Ix7s3oFQYcEnXOG:z5b5ABObc9RyetGASxIo6sOG
Threatray 1'568 similar samples on MalwareBazaar
TLSH E8351201B7C784B2E0721A368926A721B97DBE701F34CE5FA7D44E2DDA311D0A625B73
Reporter abuse_ch
Tags:NanoCore nVpn RAT scr


Avatar
abuse_ch
NanoCore RAT C2:
innocentbooii.hopto.org:55420 (185.244.30.33)

Pointing to nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@FOS-VPN.org'

inetnum: 185.244.30.0 - 185.244.30.255
netname: Freedom_Of_Speech_VPN
remarks: Before you contact us, please read:
remarks: 185.244.30.0/24 belongs to a NON-LOGGING VPN service.
remarks: We don't log any user activities.
remarks: We believe that the right to informational self-determination and the
remarks: right to privacy are essential to all citizens of all countries.
remarks: We don't host anything else on our servers than VPN software and our
remarks: customers can open a fixed number of Ports.
remarks: Like Public WiFi or Tor Exit Node Operators we cannot be held responsible
remarks: for the actions of our customers, because we simply can't (and to be
remarks: honest: don't want) to control them.
country: EU
org: ORG-SL751-RIPE
admin-c: SL12644-RIPE
tech-c: SL12644-RIPE
status: ASSIGNED PA
mnt-by: FOS-VPN-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-06-03T09:20:12Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/19495/
Detection(s):
SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-06-17 05:36:17 UTC
AV detection:
24 of 31 (77.42%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hbyb7zfwhukdnoroe3gh4jude4uzwwf4zs7qos73fs546v6owlva._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
251c55b7c7c02eec9a87eca94bb01f653317ef5d8278aeb2b511194d7057a675
NanoCore
4c4881464fd7d95cfe2d60dfd7beff8dd9c3426c15c945500db1e8714374556c
NanoCore
4cc5f468994fd62cc832482404cfc7e45232f059b9d355d3df41535a170b3470
NanoCore
6066b9b33c7336497e3fe0b7b0eb04c8fa8d27accdaad763658cd29865b2236e
NanoCore
a6b6bafbfe0f877c68f0429898e7dbc9c5307d5d2b58cce6522f9c251958ed05
NanoCore
ae9576df43dd4f5e8d48c6774e7bbbd1a6baaad219c4022dd49af9fdaec57d61
NanoCore
b78996718e94fe9cf9cc228f474b774fd7bd54133762d183ba2e6c141b3a218a
NanoCore
d1890599ae15f13b1fc26efd5221a7a20949db644edc28aa3480c0042dc0a6fc
NanoCore
d35f40a630b2e4b24ec76c354e1e66d927afe339aaba45ff3c750ed52193c910
NanoCore
dca09e669f01dcc5efa9ab9120ce3febd53868b3ba12a6e0b4574b82b3d0e392
NanoCore
+ 1'558 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
evasion persistence keylogger trojan stealer spyware family:nanocore
Link:
https://tria.ge/reports/200624-b7we3bbdd2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious behavior: GetForegroundWindowSpam
Creates scheduled task(s)
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run entry to start application
Checks whether UAC is enabled
Loads dropped DLL
Disables Task Manager via registry modification
Executes dropped EXE
NanoCore
Malware Config
C2 Extraction:
innocentbooii.hopto.org:55420
185.244.30.33:55420
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

Executable exe 38701fe4b63d1436ba2e26cc7e268327299b58bcccbf074bfb2cbbcf57ceb2ea

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/19495/

Comments