MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d4adf57d91eb47360050e595922701ac9caea76cba29c3aa036f6c7a89e9008. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 11


Intelligence 11 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d4adf57d91eb47360050e595922701ac9caea76cba29c3aa036f6c7a89e9008
SHA3-384 hash: 967a56a16ad23f4ecaa5c3c4c206dfac76070d82c9b3cecd5aa63f45041d78fe2d2b081b28d684a705a83f728bb68451
SHA1 hash: a860384ee6bf95e660a6b7b54f8630a1175d33a5
MD5 hash: 5685d50746eaf16436ba18502d9c576d
humanhash: zulu-cat-friend-arkansas
File name:3d4adf57d91eb47360050e595922701ac9caea76cba29c3aa036f6c7a89e9008
Download: download sample
Signature NanoCore
Create hunting rule
File size:827'904 bytes
First seen:2022-03-22 13:58:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'205 x SnakeKeylogger)
ssdeep 12288:1lboW+0emvix48/J1Wq+MGjW3iJgyhYz/ztG2GuydYlQO+zIOs6gAQPGz8qEN3Mn:DoWnsji5+agyezc7r0fUqoyg6
Threatray 3'976 similar samples on MalwareBazaar
TLSH T11C05AD8E3FAD5994E3F1E63D0C8F5049FF8A23004D5370A79AC7A3791952DA21829B77
Reporter JAMESWT_WT
Tags:exe NanoCore

Intelligence

File Origin
# of uploads :
1
# of downloads :
163
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/254434/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
DNS request
Creating a window
Сreating synchronization primitives
Adding an access-denied ACE
Using the Windows Management Instrumentation requests
Unauthorized injection to a recently created process
Creating a file in the %AppData% subdirectories
Creating a file in the Program Files subdirectories
Creating a file in the %temp% directory
Launching a process
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/6239d637b94fb38cb4ced234/reports/10ae5748-dc6e-48af-a21b-f0be7f9ce43d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
NanoCoreRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3ad45ef1-bc8b-4b0e-bc69-8958cadd0ac6
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/961696
Signature
.NET source code contains potential unpacker
.NET source code contains very large array initializations
.NET source code references suspicious native API functions
Contains functionality to hide user accounts
Detected Nanocore Rat
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Sigma detected: NanoCore
Sigma detected: Suspicious Add Scheduled Task From User AppData Temp
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Nanocore RAT
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 594179 Sample: GHsoHti4Ax Startdate: 22/03/2022 Architecture: WINDOWS Score: 100 42 robi54.duckdns.org 2->42 44 purecry54.duckdns.org 2->44 50 Malicious sample detected (through community Yara rule) 2->50 52 Multi AV Scanner detection for dropped file 2->52 54 Multi AV Scanner detection for submitted file 2->54 56 15 other signatures 2->56 9 GHsoHti4Ax.exe 3 2->9         started        13 dhcpmon.exe 2 2->13         started        15 dhcpmon.exe 2 2->15         started        17 GHsoHti4Ax.exe 2 2->17         started        signatures3 process4 file5 40 C:\Users\user\AppData\...behaviorgraphHsoHti4Ax.exe.log, ASCII 9->40 dropped 60 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->60 62 Uses schtasks.exe or at.exe to add and modify task schedules 9->62 64 Injects a PE file into a foreign processes 9->64 19 GHsoHti4Ax.exe 1 12 9->19         started        signatures6 process7 dnsIp8 46 robi54.duckdns.org 31.210.20.129, 49780, 49781, 49783 PLUSSERVER-ASN1DE Netherlands 19->46 48 purecry54.duckdns.org 19->48 32 C:\Program Files (x86)\...\dhcpmon.exe, PE32 19->32 dropped 34 C:\Users\user\AppData\Roaming\...\run.dat, Non-ISO 19->34 dropped 36 C:\Users\user\AppData\Local\...\tmp45D5.tmp, XML 19->36 dropped 38 C:\...\dhcpmon.exe:Zone.Identifier, ASCII 19->38 dropped 58 Hides that the sample has been downloaded from the Internet (zone.identifier) 19->58 24 schtasks.exe 1 19->24         started        26 schtasks.exe 1 19->26         started        file9 signatures10 process11 process12 28 conhost.exe 24->28         started        30 conhost.exe 26->30         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d4adf57d91eb47360050e595922701ac9caea76cba29c3aa036f6c7a89e9008/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2022-03-15 15:59:06 UTC
File Type:
PE (.Net Exe)
Extracted files:
3
AV detection:
20 of 42 (47.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hvfn6v6zd22hgyafbzmvsitqdle4v2twzorjyovag33mpke6saea._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
14d1b90e0c7a7109c610280bcf7201c4ed8b565e04ca74ec049c07f5fa8df337
NanoCore
1c048355497ad9461aa8c36b0a16783e459f2e11491bf4fdc6221545a9ae93e7
NanoCore
4682c806dd41aaccbb4f8bf3ead4fd322c302f334e3edc6dc06292bbd32335a0
NanoCore
4f7da7d6fb331a8098d4ce354690ffc64d8f0225307b406e722548109e669d4d
NanoCore
61004944921826aa2cdf48c60720daa7e45a6694606ce82e62ea38c655856c0f
NanoCore
6f8845fdf3004769d9dadd3f9eb2b7eb26eaaf644809f16772a239a23b9d3433
NanoCore
+ 3'966 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/220322-q94aeafgc4/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Maps connected drives based on registry
Checks BIOS information in registry
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
NanoCore
Malware Config
C2 Extraction:
purecry54.duckdns.org:8686
robi54.duckdns.org:8686
Unpacked files
SH256 hash:
3d4adf57d91eb47360050e595922701ac9caea76cba29c3aa036f6c7a89e9008
MD5 hash:
5685d50746eaf16436ba18502d9c576d
SHA1 hash:
a860384ee6bf95e660a6b7b54f8630a1175d33a5
Link:
https://www.unpac.me/results/12c27596-8ff0-4334-b33d-6392284d1f92/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.38
Link:
https://yomi.yoroi.company/submissions/3d4adf57d91eb47360050e595922701ac9caea76cba29c3aa036f6c7a89e9008

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:malware_Nanocore_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:MALWARE_Win_NanoCore
Create hunting rule
Author:ditekSHen
Description:Detects NanoCore
Rule name:nanocore_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Feb18_1_RID2DF1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:Nanocore_RAT_Gen_2_RID2D96
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_nanocore_w0
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/254434/

Comments