MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 41617ac4431c229ba27bf94617b465309e7f502ae5088cd12ee571a0428ea120. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 9

Intelligence 9 IOCs YARA 6 File information Comments

SHA256 hash:	41617ac4431c229ba27bf94617b465309e7f502ae5088cd12ee571a0428ea120
SHA3-384 hash:	4ea0ec6a074139e879024c222226408a4b82bb839e7d129bdacffdd854b0a3d4bca4d90109874a55f0483adf11f438d8
SHA1 hash:	776d3d7e39a8b3e72e2e9b5c36a615e3157d05ad
MD5 hash:	36f13aad903e851544fe137feca3435b
humanhash:	leopard-mockingbird-comet-grey
File name:	BFSV-1F(N)_1B-8B_ANSI.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	346'624 bytes
First seen:	2021-01-08 08:22:48 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	6a01311f3b93e75b0932a2018ac2171e (2 x Formbook, 1 x NetWire, 1 x NanoCore)
ssdeep	6144:cvnifsw4lp4UlclMNJO2OOZNYQjJntWar4u0PYlcf2ELdYyfHwgF2r2QQvipF:snL3lklmOkYstWa/7cfNLyR2kF
Threatray	1'884 similar samples on MalwareBazaar
TLSH	7774F126A345F06BF48241FDB41DEBB990043938A4A4D043B7C1AF1774727EAD969F2B
Reporter	abuse_ch
Tags:	exe NanoCore RAT

abuse_ch

Malspam distributing NanoCore:

HELO: mail-smail-vm20.hanmail.net
Sending IP: 203.133.180.201
From: Mr Hong <lub43@hanmail.net>
Subject: Request for Quotation for PO#BGR5-98247
Attachment: POBGR5-98247.cab (contains "BFSV-1F(N)_1B-8B_ANSI.exe")

NanoCore RAT C2:
45.138.49.96:9999

Intelligence

File Origin

# of uploads :

# of downloads :

185

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

BFSV-1F(N)_1B-8B_ANSI.exe

Verdict:

Malicious activity

Analysis date:

2021-01-08 08:23:58 UTC

Tags:

trojan nanocore rat

Link:

https://app.any.run/tasks/75ed73c2-c4e9-4bd2-9765-3e773250b6bd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

NanoCore

Link:

https://www.capesandbox.com/analysis/110936/

Detection(s):

SecuriteInfo.com.BehavesLike.Win32.Generic.fc.15060.UNOFFICIAL

SecuriteInfo.com.Artemis0CDEF98F5ED0.11763.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Result

Threat name:

Nanocore

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/576458

Signature

Antivirus / Scanner detection for submitted sample

Detected Nanocore Rat

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

Sigma detected: NanoCore

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Nanocore RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

nanocore

Link:

https://mwdb.cert.pl/sample/41617ac4431c229ba27bf94617b465309e7f502ae5088cd12ee571a0428ea120/

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ifqxvrcddqrjxit37fdbpndfgcph6ubk4ueizujo4vy2aquoueqa._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

5756a30d832082dc1a3eebf4b5dc74d0ee354a5818b8a99b057f50af588207f9

NanoCore

5b474ca6fc8158bd6f14d53bca8962f25db3392dfe324f49ddf376610bd785e4

NanoCore

68101d145825fc980210f1f56638011d98eeaf5c53fb734b62a80dac6489f2e3

NanoCore

8d8236eed9973c50c80b31c7aed1bab0a46dfdcc9b1f1ce749aa7d88963abe1b

NanoCore

8f4dce7ad41fd654a99038ce4b52b7b276795fd56a6c376eb58e40e4600ebe52

NanoCore

bf487ff7cdbbd998b633b1858a939d8c808bcce65ab9937695475b39deea70a8

NanoCore

d34bf3220c17f2188a05d855c4e5f0501ebe86407daceaa9879ef3bcefc97b12

NanoCore

dffa4b4cf6fc7f869229acf3c1f5b1cce1f9b29913f1cc19ae47a4aeff580c49

NanoCore

edafe7e62738e180cb882d93f37d2d306627aef482d6f7a7a06c69198c61cd58

NanoCore

+ 1'874 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

family:nanocore evasion keylogger spyware stealer trojan

Link:

https://tria.ge/reports/210108-fm8tqr8p82/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

Checks whether UAC is enabled

Uses the VBS compiler for execution

NanoCore

Unpacked files

SH256 hash:

41617ac4431c229ba27bf94617b465309e7f502ae5088cd12ee571a0428ea120

MD5 hash:

36f13aad903e851544fe137feca3435b

SHA1 hash:

776d3d7e39a8b3e72e2e9b5c36a615e3157d05ad

Link:

https://www.unpac.me/results/2b883129-fb81-4aa9-a0f9-2f2781ce0cb5/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

XPACK

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/41617ac4431c229ba27bf94617b465309e7f502ae5088cd12ee571a0428ea120

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	nanocore_rat Create hunting rule
Author:	jeFF0Falltrades

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/