MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4bcccb96fd01c27fbf6d422d7dc3d53b997cd928b11baab0d449367137706aa0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 6

Intelligence 6 IOCs YARA 5 File information Comments

SHA256 hash:	4bcccb96fd01c27fbf6d422d7dc3d53b997cd928b11baab0d449367137706aa0
SHA3-384 hash:	2ebaa24c551b54dd7a39c64c3a68083f75f87c925244117986043c1a3bd1c4b739cb3f687a1b457c5c4d10a1b1cf0d1e
SHA1 hash:	afb660a5beca8ea41d1ef71056e9a88670817d70
MD5 hash:	253d0e9f465cc6bb5fd6a960b5cbbe18
humanhash:	nine-victor-one-grey
File name:	πληρωμή_97656569.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	371'712 bytes
First seen:	2020-06-15 12:41:42 UTC
Last seen:	2020-06-16 09:35:17 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	6144:V985f7qvl4MPXK41Hq7NvXTxoDgRDl0vP/FOuxV6Ny1G3RM3pPA3o8KzCr11nV:V6Tqvlf/1QN4NH/FOuxp106PAgy
Threatray	1'194 similar samples on MalwareBazaar
TLSH	4984F10937E99721E2FA8F7584F2144083B0B83A7A23E75F5FC530AD19B2BD48961B57
Reporter	abuse_ch
Tags:	exe geo GRC NanoCore nVpn RAT

abuse_ch

Malspam distributing NanoCore:

HELO: vps.solkange.com
Sending IP: 45.95.169.125
From: Basil Gaia <info@solkange.com>
Subject: Re: επιβεβαίωση πληρωμής_97656569_06_15_2020
Attachment: πληρωμή_97656569.r11 (contains "πληρωμή_97656569.exe")

NanoCore RAT C2:
confirma.ooguy.com:6331 (185.165.153.6)

Pointing to nVpn:

% Information related to '185.165.153.0 - 185.165.153.255'

% Abuse contact for '185.165.153.0 - 185.165.153.255' is 'abuse@privacy-matters.co'

inetnum: 185.165.153.0 - 185.165.153.255
netname: PRIVACY_MATTERS
remarks: This prefix belongs to a VPN service provider.
remarks: For us the privacy of our customers matters, which means we store no logs
remarks: related to any IP addresses.
remarks: Spamhaus, please note that blacklisting the clean prefixes of our hosting
remarks: partners and upstream providers is an act of coercion and will no longer
remarks: be tolerated.
remarks: Coercion is punishable by a custodial sentence or by a monetary penalty.
remarks: If you continue such practice we will not only take legal actions against
remarks: your organization, but also make such blackmailing attempts public in the
remarks: media.
country: AT
admin-c: PMVS3-RIPE
tech-c: PMVS3-RIPE
org: ORG-PMVS1-RIPE
status: ASSIGNED PA
mnt-by: PM-MNT
created: 2019-10-18T12:14:26Z
last-modified: 2019-10-18T13:31:16Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

NanoCore

Link:

https://www.capesandbox.com/analysis/10402/

Detection(s):

SecuriteInfo.com.Generic.mg.80fc162f354d28e3.20640.UNOFFICIAL

Gathering data

Threat name:

ByteCode-MSIL.Trojan.Malrep

Status:

Malicious

First seen:

2020-06-15 12:43:04 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

18 of 24 (75.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=jpgmxfx5ahbh7p3niiwx3q6vhomxzwjiwen2vmguje3hcn3qnkqa._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

70e32f51fdd7cbade222e6e7acc86c8982eba7b1e591449dcaf2566946104d11

NanoCore

77aed51893a8a5e2ab24824dddad42c99cfb46baba36dbe90c72cd8ff6723b7f

NanoCore

8e5c41390f995c72ea749d6f141ec790ab5a61e843355592c2956ee01d8bb005

NanoCore

97f67123bf9b506479f14240bb2045a9e5e12062039ad4a60c065232b293ea0c

NanoCore

a388721677699e1816b5a7812b0c7bfa301cbe1539aae18fad07c98f85e16168

NanoCore

ccd5df3e21e1543a8cb3f92b37276be48adec9859f12096faaca589a39a0f99b

NanoCore

e4a764560fc747261834c1568d5280725a64036f720ad42ce847353cb4841331

NanoCore

f680bde2f9df0bf77497f36b16e0b1a8b08c847b4e9be02f9842e7d457169437

NanoCore

ffd474ba42b484a0c7eb8688e37334d55e65c49dcb88dcf3bc542276cd7d5348

NanoCore

+ 1'184 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

family:nanocore keylogger spyware stealer trojan

Link:

https://tria.ge/reports/201109-cbyd4edajs/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetThreadContext

NanoCore

Malware Config

C2 Extraction:

confirma.ooguy.com:6331
127.0.0.1:6331

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/