MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51b5318ef13c455e2308608371ffd6442ecbbe2566715429bdb67b9883b8ba28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51b5318ef13c455e2308608371ffd6442ecbbe2566715429bdb67b9883b8ba28
SHA3-384 hash: 10e7d4666bc70fa59978890e50afeab59cb3e37b5d0b6f33df3041655e60684cba75278556507bbe73a79787dd7f241c
SHA1 hash: e562f62a4f4524ada9d3c24c323811061a345fca
MD5 hash: 9a13e8ac4b9a815310bd80d57b07ed74
humanhash: mississippi-steak-berlin-failed
File name:kgQdY5y7hgR0DzF.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:790'528 bytes
First seen:2020-10-07 10:48:57 UTC
Last seen:2020-10-07 12:24:27 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'477 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:p3STJi8O/2XftmdLUdFEg/yLDVBk3eIReKa/L5KQpeRydK+WOwmXidoi+Bb0Q6iv:VwiV/2X1mdqz/yH7YaAudK+NQdoWO
Threatray 995 similar samples on MalwareBazaar
TLSH 84F4BE9836503FDEC81F893299581C24A6636C664F0BD7CBA0533E99BA3D6978F111F3
Reporter abuse_ch
Tags:exe HSBC NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: gmail.com
Sending IP: 209.58.149.66
From: HSBC Advising Service <nadotubesales@gmail.com>
Subject: Payment Advice - Advice Ref:[GLV930760211]
Attachment: HSBC.GZ (contains "kgQdY5y7hgR0DzF.exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
150
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/68898/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Creating a file
Creating a file in the %AppData% subdirectories
Creating a file in the Program Files subdirectories
Using the Windows Management Instrumentation requests
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Sending a TCP request to an infection source
Enabling autorun by creating a file
Unauthorized injection to a system process
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/484022
Signature
.NET source code contains potential unpacker
Binary contains a suspicious time stamp
Detected Nanocore Rat
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM_3
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/51b5318ef13c455e2308608371ffd6442ecbbe2566715429bdb67b9883b8ba28/
Threat name:
ByteCode-MSIL.Backdoor.NanoBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-07 07:11:36 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kg2tddxrhrcv4iyimcbxd76wiqxmxprfmzyvikn5wz5zra5yxiua._file
Verdict:
unknown
Similar samples:
080a6fbf91637b683b6f363092f9b7d6e75b8442c6f9df32ffea0788e16fafdf
NanoCore
1d6911646bb6264c99bcc18c6b0ef9ee8b9976e08d308fb30c67d0b89df63e0c
NanoCore
6f2bf53e333052923d34bb892bfbe30575270fa08cf40828767bf92bca15f52d
NanoCore
855f809443686aa4f596d4a7727300af48b7b02ac78ae40e7eb4026a88732df5
NanoCore
95aa3a1503e68851a57de64294791d3cc97584bf89b27586be513a24abe1ef2b
NanoCore
ad0fbe6d8f278dac33ae5ffa7168aadbcfbf82b04fb6b3d443aa4157fa1149b1
NanoCore
c176d7b838d9146e64732d143cda3c07f4c76b693ab940ca045a51d07c52faae
NanoCore
d629c8de27a6f2c0315cb88b5cf940d5f67c63177fba59adf564c689dcff7fd1
NanoCore
edb014655bf6c7464325b44856019f5fb1aedb94fe9ed988faa0c77d82875d3c
NanoCore
f544548656da95993af2c115a9af5eb499741c1c9914ef556bbd599391ae769e
NanoCore
+ 985 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
keylogger trojan stealer spyware family:nanocore persistence
Link:
https://tria.ge/reports/201007-85ynmarc76/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
NanoCore
Malware Config
C2 Extraction:
79.134.225.121:1985
127.0.0.1:1985
Unpacked files
SH256 hash:
51b5318ef13c455e2308608371ffd6442ecbbe2566715429bdb67b9883b8ba28
MD5 hash:
9a13e8ac4b9a815310bd80d57b07ed74
SHA1 hash:
e562f62a4f4524ada9d3c24c323811061a345fca
Link:
https://www.unpac.me/results/12e105e7-79ba-4977-94df-7294031a99b7/
SH256 hash:
959492a38bc31573193f7190de288815407545846c8a063366380636edcfa015
MD5 hash:
64a8c1a851c4eb1d694bd86bd278800e
SHA1 hash:
2974cafa7739793bba7d1f8c712dbb0500d35ced
Link:
https://www.unpac.me/results/12e105e7-79ba-4977-94df-7294031a99b7/
SH256 hash:
891173a5cc02229f08f12d5e01f2dbaaa2cbdf05a8d842c0f8aeacf40e983bb2
MD5 hash:
821cfe1badc8f246bca44981b68abd74
SHA1 hash:
7218320d767f59becf7adb9eee182330a96a4812
Detections:
win_nanocore_w0
Create hunting rule
Link:
https://www.unpac.me/results/12e105e7-79ba-4977-94df-7294031a99b7/
Parent samples :
51b5318ef13c455e2308608371ffd6442ecbbe2566715429bdb67b9883b8ba28
2894c28d4972a081f7d55a74a42b57eec8dab10ed4682be6f3f86b1393fc4aa2
b494f8418799f094e809de1bbce3970f01ae7f19a0db6c494d25656ae7a04d0a
SH256 hash:
607f04646c9f16f7c23fa69d4b8f660fc7c44d40e4f73a0c70a2b315debdaa8b
MD5 hash:
a90baadadf904455325f7bc787185c7b
SHA1 hash:
7d833bb819d638008c98be469b05db2feaf201cd
Link:
https://www.unpac.me/results/12e105e7-79ba-4977-94df-7294031a99b7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kryptik
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/51b5318ef13c455e2308608371ffd6442ecbbe2566715429bdb67b9883b8ba28

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

gz 0fab7e02b3d6332bc47944f0aef8f48619ba4f552233a58367d868a8d6bb8a70

NanoCore

Executable exe 51b5318ef13c455e2308608371ffd6442ecbbe2566715429bdb67b9883b8ba28

(this sample)

  
Dropped by
MD5 ef97c228edeaa1d3649875c36711d6a2
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/68898/
  
Dropped by
SHA256 0fab7e02b3d6332bc47944f0aef8f48619ba4f552233a58367d868a8d6bb8a70

Comments