MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 485868eac79a5a53120af21c63d317cc033ff0855da3684f16c30753a8d961c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 5


Intelligence 5 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 485868eac79a5a53120af21c63d317cc033ff0855da3684f16c30753a8d961c2
SHA3-384 hash: f1b0161ee131aae771346a052cca9e443341291912f626a8771c28b2d645233f88d1df7b71b13dffa2eeaad8558d04cf
SHA1 hash: c085ba598ac85510b8217f698b4d67e8ae9b9fe0
MD5 hash: 9061b661345f46bf163d46616e582482
humanhash: single-nitrogen-mockingbird-georgia
File name:new.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:892'928 bytes
First seen:2020-05-11 08:02:54 UTC
Last seen:2020-05-11 08:58:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'740 x AgentTesla, 19'600 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:qJA7q/B4fEdydUgLmJ6Rm8AvwOyC/cciYDcTATIDowYS917oZ:nSnsVfRQwgcc3cUTIDowzb7oZ
Threatray 1'078 similar samples on MalwareBazaar
TLSH 1815BF07F6AC8E16C489437AC08FD230A3B49D865263F75F5EC8BEEB3D573998846116
Reporter Racco42
Tags:exe NanoCore

Intelligence

File Origin
# of uploads :
2
# of downloads :
88
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.KillProc2.10377.451.18575.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Nanocore
Create hunting rule
Status:
Malicious
First seen:
2020-05-08 12:58:54 UTC
File Type:
PE (.Net Exe)
Extracted files:
25
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jbmgr2whtjnfgeqk6ioghuyxzqbt74eflwrwqtywymdvhkgzmhba._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
062cf3944b0b563efc115688ff8910721db670950acf80c0020351b7d97b48c5
NanoCore
0c75ced9ff9cb13255c6bf59e1e817b861f1c25e47d1aab2c891617615cde1e6
NanoCore
4faa4683bd7134b0823bd0f04f894136bab28fb33f6163f803d08b6dd80a36c2
NanoCore
55374abf463b7c308310fc62d2d25da0059234c002669bae24a710cf695be746
NanoCore
819b7cdae5437e09dddc2263080df829d2e8ba725f4364bfddf0cd10eb848692
NanoCore
a032cd20c067b83f1cab391af7671f7ae669de96dbf995f08580b14d218aeccc
NanoCore
baf5098a21b4d571d2c23727229db27ee1c81216aeddbe59ee391f94154ca33d
NanoCore
d0a8b39bc4bd58191a4b6db1a71621e7d9e2e124c05ad01922aafb9eba72205a
NanoCore
dca09e669f01dcc5efa9ab9120ce3febd53868b3ba12a6e0b4574b82b3d0e392
NanoCore
f9614b985dcb06d9c40448e4ecf1a94ce2cd69e54f6acbeca7b6deec54aafdb3
NanoCore
+ 1'068 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-ysxm5sys1e/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
NanoCore
Malware Config
C2 Extraction:
chaya.ddns.net:1960
185.140.53.208:1960
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

Executable exe 485868eac79a5a53120af21c63d317cc033ff0855da3684f16c30753a8d961c2

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments