MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4682c806dd41aaccbb4f8bf3ead4fd322c302f334e3edc6dc06292bbd32335a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4682c806dd41aaccbb4f8bf3ead4fd322c302f334e3edc6dc06292bbd32335a0
SHA3-384 hash: 48e6cecf3f9261f283af8eba899c78b5052585a09e357db56f5c25b2c36bff7b02e5246384e58852a989a6a0e5eb572b
SHA1 hash: 0160db5e53ae2f0d424630e221dfa0d85432db0c
MD5 hash: 678852877f562dde93195d84dbfc4623
humanhash: virginia-louisiana-september-video
File name:4682C806DD41AACCBB4F8BF3EAD4FD322C302F334E3ED.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:379'872 bytes
First seen:2022-03-20 23:55:54 UTC
Last seen:2022-03-21 01:51:22 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla)
ssdeep 6144:rGi1iX+CN22DYlvAofqno09NFnuoNX4MXNuC3ZJp+7K+LHqKwwsNw6sXY+/:xh2yhfqZEoNX4EuIZJyBRs+XXY0
Threatray 5'067 similar samples on MalwareBazaar
TLSH T1B284230AF0D58CF7CDB61F3235B98AA1E2F781C902407E078BA4AE2D92636D557537E1
File icon (PE):PE icon
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter abuse_ch
Tags:exe NanoCore RAT


Avatar
abuse_ch
NanoCore C2:
184.75.223.235:3782

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
184.75.223.235:3782 https://threatfox.abuse.ch/ioc/428644/

Intelligence

File Origin
# of uploads :
2
# of downloads :
411
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/253177/
Detection(s):
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.12395.27768.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating a file in the %temp% directory
Creating a file
Unauthorized injection to a recently created process
Сreating synchronization primitives
Creating a file in the %AppData% subdirectories
Creating a file in the Program Files subdirectories
Launching a process
Searching for synchronization primitives
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control.exe overlay packed shell32.dll wacatac
Link:
https://www.filescan.io/uploads/6237bf14dfdfa8501cc3add9/reports/b99a222b-f9e2-431d-9c66-655534b1116e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
NanoCoreRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8d7f93de-4623-4357-a0f3-0889bde173ac
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/960354
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Detected Nanocore Rat
Detected unpacking (creates a PE file in dynamic memory)
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Sigma detected: Suspicious Add Scheduled Task From User AppData Temp
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 592835 Sample: 4682C806DD41AACCBB4F8BF3EAD... Startdate: 21/03/2022 Architecture: WINDOWS Score: 100 53 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->53 55 Multi AV Scanner detection for domain / URL 2->55 57 Found malware configuration 2->57 59 13 other signatures 2->59 8 4682C806DD41AACCBB4F8BF3EAD4FD322C302F334E3ED.exe 17 2->8         started        12 4682C806DD41AACCBB4F8BF3EAD4FD322C302F334E3ED.exe 16 2->12         started        14 dhcpmon.exe 16 2->14         started        process3 file4 45 C:\Users\user\AppData\...\trgacsmyaqo.dll, PE32 8->45 dropped 63 Detected unpacking (creates a PE file in dynamic memory) 8->63 65 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 8->65 67 Uses schtasks.exe or at.exe to add and modify task schedules 8->67 16 4682C806DD41AACCBB4F8BF3EAD4FD322C302F334E3ED.exe 1 15 8->16         started        47 C:\Users\user\AppData\...\trgacsmyaqo.dll, PE32 12->47 dropped 69 Injects a PE file into a foreign processes 12->69 21 4682C806DD41AACCBB4F8BF3EAD4FD322C302F334E3ED.exe 3 12->21         started        49 C:\Users\user\AppData\...\trgacsmyaqo.dll, PE32 14->49 dropped 23 dhcpmon.exe 3 14->23         started        signatures5 process6 dnsIp7 51 184.75.223.235, 3782, 49755, 49759 AMANAHA-NEWCA Canada 16->51 33 C:\Program Files (x86)\...\dhcpmon.exe, PE32 16->33 dropped 35 C:\Users\user\AppData\Roaming\...\run.dat, data 16->35 dropped 37 C:\Users\user\AppData\Local\...\tmpEEF1.tmp, XML 16->37 dropped 39 C:\...\dhcpmon.exe:Zone.Identifier, ASCII 16->39 dropped 61 Hides that the sample has been downloaded from the Internet (zone.identifier) 16->61 25 schtasks.exe 1 16->25         started        27 schtasks.exe 1 16->27         started        41 4682C806DD41AACCBB...302F334E3ED.exe.log, ASCII 21->41 dropped 43 C:\Users\user\AppData\...\dhcpmon.exe.log, ASCII 23->43 dropped file8 signatures9 process10 process11 29 conhost.exe 25->29         started        31 conhost.exe 27->31         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4682c806dd41aaccbb4f8bf3ead4fd322c302f334e3edc6dc06292bbd32335a0/
Threat name:
Win32.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2022-03-20 01:55:00 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
22 of 42 (52.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i2bmqbw5igvmzo2prpz6vvh5giwdalztjy7ny3oamkjlxuzdgwqa._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
14d1b90e0c7a7109c610280bcf7201c4ed8b565e04ca74ec049c07f5fa8df337
NanoCore
1c048355497ad9461aa8c36b0a16783e459f2e11491bf4fdc6221545a9ae93e7
NanoCore
4f7da7d6fb331a8098d4ce354690ffc64d8f0225307b406e722548109e669d4d
NanoCore
525b7d66ed7032178d6fed1686560143655af76f12c8b344f03f09632a4287d7
NanoCore
61004944921826aa2cdf48c60720daa7e45a6694606ce82e62ea38c655856c0f
NanoCore
6f8845fdf3004769d9dadd3f9eb2b7eb26eaaf644809f16772a239a23b9d3433
NanoCore
+ 5'057 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger persistence spyware stealer suricata trojan
Link:
https://tria.ge/reports/220320-3y1flaggeq/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Checks whether UAC is enabled
Loads dropped DLL
NanoCore
suricata: ET MALWARE Possible NanoCore C2 60B
Malware Config
C2 Extraction:
184.75.223.235:3782
Unpacked files
SH256 hash:
4682c806dd41aaccbb4f8bf3ead4fd322c302f334e3edc6dc06292bbd32335a0
MD5 hash:
678852877f562dde93195d84dbfc4623
SHA1 hash:
0160db5e53ae2f0d424630e221dfa0d85432db0c
Link:
https://www.unpac.me/results/8e1a14f4-2475-404f-b310-425478f2a66d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4682c806dd41aaccbb4f8bf3ead4fd322c302f334e3edc6dc06292bbd32335a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:malware_Nanocore_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:MALWARE_Win_NanoCore
Create hunting rule
Author:ditekSHen
Description:Detects NanoCore
Rule name:nanocore_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Feb18_1_RID2DF1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:Nanocore_RAT_Gen_2_RID2D96
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:win_nanocore_w0
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/253177/

Comments