MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e8fda53d335f929c539e5fbc47a79e166ecbfda4752c50544c429a199056c62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3e8fda53d335f929c539e5fbc47a79e166ecbfda4752c50544c429a199056c62
SHA3-384 hash: f4f47910ff33528d77e333f4a2f630df016b248c51ed145568b2e7dda3ed791090cfcd90ea72a345cd27c238ac8d101c
SHA1 hash: 8f3494573d423b391f8c00e59bca0cb42b7de9e3
MD5 hash: b0548b62207c1482f28ac1d4ffd8bb9c
humanhash: autumn-shade-edward-nevada
File name:Swift-052520.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:723'968 bytes
First seen:2020-05-25 09:33:45 UTC
Last seen:2020-05-25 10:45:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash e69d91ce4b5556e616458c5a122c112e (4 x AgentTesla, 3 x Loki, 2 x NanoCore)
ssdeep 12288:dC1TxYROXXH+NrZEb3StxjYr5Cekz6UCJ1qngkF+V02mxk9:stPHeO3q21Cj6zTqngkFMNmY
Threatray 2'800 similar samples on MalwareBazaar
TLSH A6F4AE22F2A00433D1A3967D9C1B9778E83EFE51393869872BE49C4C6F393417976297
Reporter jarumlus
Tags:NanoCore

Intelligence

File Origin
# of uploads :
3
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Injector
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 09:47:00 UTC
File Type:
PE (Exe)
Extracted files:
263
AV detection:
25 of 31 (80.65%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
hawkeyekeylogger
Create hunting rule
emotet
Create hunting rule
Similar samples:
02b10c6690bd0ed3e9b675553519df78a7ede63a398d68304043eacb691fd305
NanoCore
1faba4e3aa2465396894cc4b71f97f0b50c593245bd03421db8e4e996e9c3159
NanoCore
90474a0270106b33e3208a63041d2e4d013b1d2b415bf3bf44e9a5ab685d0531
NanoCore
aee0158a9f836306b64e6c99e732073aa81fe23944c91a3d0fcf9a92508019ec
NanoCore
b2446dade622509df2cd602bad484ae10a3e615f0766ac662ec87c9d68a4b21b
NanoCore
bd23c3a3d5215798a115525fe15803ee5f4393ae77d49e081770761beecb14ea
NanoCore
c18ae57203cb03daa5d28d11862951854656f2ce1f7d74237d3972345e7140ad
NanoCore
c83638f4f7a2be7e116bd5efcae9df5522724b776f1334326aeadec2db16e000
NanoCore
fd54073286010523ef59ce428c3ae8b92f87abce1027ed232befe46499bf5e53
NanoCore
fd889953ad0e22f6fb8601866cf6d12b1a4d3027e2e885836510a503a2892b7d
NanoCore
+ 2'790 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger spyware stealer trojan upx
Link:
https://tria.ge/reports/201109-dv1w3vy896/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Drops startup file
UPX packed file
NanoCore
Malware Config
C2 Extraction:
:4050
185.244.29.216:4050
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

z d6fbd423c62791d359d78d0662aa6529dcd369eea69cff79401d355da74f9928

NanoCore

Executable exe 3e8fda53d335f929c539e5fbc47a79e166ecbfda4752c50544c429a199056c62

(this sample)

  
Dropped by
MD5 3b903ee71faaf7231f3d6f5e91c97e91
  
Dropped by
SHA256 d6fbd423c62791d359d78d0662aa6529dcd369eea69cff79401d355da74f9928
  
Delivery method
Distributed via e-mail attachment

Comments