MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5525b80e4317e08cea05a9e1940b367d0fe98094b8624823d14b360fca5f55c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	5525b80e4317e08cea05a9e1940b367d0fe98094b8624823d14b360fca5f55c9
SHA3-384 hash:	e1dbbb6944b63400d02fadf56fa9a10c586f5b055d821df550c4eeaa310a788d5a6ed3374691cbfe31f7c768e2841f47
SHA1 hash:	5ce26ab8dba719050da28a3d8de060eb7fa83d57
MD5 hash:	f3d4c9b6988fed8fa6068c7c68035cd9
humanhash:	zebra-kitten-fifteen-oxygen
File name:	Quotation Prices Purchase Order.xlsx
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	594'432 bytes
First seen:	2020-09-06 16:57:16 UTC
Last seen:	Never
File type:	xlsx
MIME type:	application/encrypted
ssdeep	12288:7joSj87hgWm0B/A++gwAJCC/foMqDdAd7CIC80foi59qyJ:ISUhgWfdd9//foMqDdAd+IC3oiuyJ
TLSH	B4C4234633D05FA7F76F4C7B18C4CA81E2B09D2C63A8D31F609A7C2A847E75CE529660
Reporter	abuse_ch
Tags:	NanoCore nVpn RAT xlsx

abuse_ch

Malspam distributing NanoCore:

HELO: smtpfilter.mailtop.net
Sending IP: 210.122.9.53
From: Librisa Zhou <maybelle@eastko.co.kr>
Reply-To: Librisa Zhou <shabi@gol.com>
Subject: my subject
Attachment: Quotation Prices Purchase Order.xlsx

NanoCore payload URL:
http://5.135.73.120/zero.exe

NanoCore RAT C2s:
vreme.ddns.net:1012 (185.244.30.251)
185.244.30.251:1012

Hosted on nVpn:

% Information related to '185.244.30.0 - 185.244.30.255'

% Abuse contact for '185.244.30.0 - 185.244.30.255' is 'abuse@privacyfirst.sh'

inetnum: 185.244.30.0 - 185.244.30.255
remarks: This prefix is assigned to The PRIVACYFIRST Project, which
remarks: operates infrastructure jointly used by various VPN service
remarks: providers. We have a very strong focus on privacy and freedom.
remarks: In case of abuse, we encourage all international law enforcement
remarks: agencies to get in touch with our abuse contact. Due to the fact
remarks: that we keep no logs of user activities and only share data when
remarks: it is legally required under our jurisdiction, it is very unlikely
remarks: for a demand of user information to be successful. Still, that
remarks: should not deter you from reaching out.
netname: PRIVACYFIRST-EU4
country: EU
admin-c: TPP15-RIPE
tech-c: TPP15-RIPE
org: ORG-TPP6-RIPE
status: ASSIGNED PA
mnt-by: PRIVACYFIRST-MNT
created: 2019-10-29T14:10:27Z
last-modified: 2020-07-28T21:04:34Z
source: RIPE

Intelligence

File Origin

# of uploads :

# of downloads :

285

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

PUA.Doc.Packed.EncryptedDoc-6563700-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Creating a file in the %AppData% directory

Adding an access-denied ACE

Creating a file in the %AppData% subdirectories

DNS request

Sending an HTTP GET request

Launching a file downloaded from the Internet

Connection attempt to an infection source

Creating a process from a recently created file

Unauthorized injection to a system process

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5525b80e4317e08cea05a9e1940b367d0fe98094b8624823d14b360fca5f55c9/

Threat name:

Win32.Trojan.Ymacco

Status:

Malicious

First seen:

2020-09-06 09:24:25 UTC

AV detection:

16 of 29 (55.17%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=kus3qdsdc7qiz2qfvhqziczwpuh6taeuxbreqi6rjm3a7ss7kxeq._file

Result

Malware family:

nanocore

Score:

10/10

Tags:

keylogger trojan stealer spyware family:nanocore

Link:

https://tria.ge/reports/200906-z6qj95mb1e/

Behaviour

Launches Equation Editor

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Program crash

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Loads dropped DLL

Uses the VBS compiler for execution

Blacklisted process makes network request

Executes dropped EXE

NanoCore

Malware Config

C2 Extraction:

vreme.ddns.net:1012
185.244.30.251:1012

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/5525b80e4317e08cea05a9e1940b367d0fe98094b8624823d14b360fca5f55c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.