MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 56f803925d37e489e72c9e3a7bf128d46fd29b62f858961b2f644edf09530602. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 8


Intelligence 8 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 56f803925d37e489e72c9e3a7bf128d46fd29b62f858961b2f644edf09530602
SHA3-384 hash: 1fd5e978457ead6acc9b33a02cde955b6dcb0ab86c9d35f577a8ee7fb6f6633997941240703e5e9979f4b0ef3520807f
SHA1 hash: 7f181a1500e1b2cbf7c76466210c58d166c30c62
MD5 hash: ceab5875bc8300bade1fa862d446af5b
humanhash: east-bluebird-jersey-mars
File name:transfer pdf.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:768'000 bytes
First seen:2021-05-03 07:30:31 UTC
Last seen:2021-05-03 12:49:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'657 x AgentTesla, 19'468 x Formbook, 12'206 x SnakeKeylogger)
ssdeep 12288:YHybHxkWZyyccgdFi7YuybPUMHMevVw4vPPQW83vMj:YI+WZyLcgdITmUDkVwePYW8fI
Threatray 9 similar samples on MalwareBazaar
TLSH 29F4222737E4C622DE7D2B764675104007B5F20ADA13EB0E2C9990BE6B2B791C7513EB
Reporter abuse_ch
Tags:exe NanoCore RAT


Avatar
abuse_ch
NanoCore C2:
23.105.131.171:4040

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
23.105.131.171:4040 https://threatfox.abuse.ch/ioc/28090/

Intelligence

File Origin
# of uploads :
4
# of downloads :
121
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
transfer_pdf.exe
Verdict:
Malicious activity
Analysis date:
2021-05-03 12:29:55 UTC
Tags:
trojan nanocore rat
Link:
https://app.any.run/tasks/972b8a4c-d894-42a2-ad2b-febd5fda4cc1

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/148286/
Detection(s):
SecuriteInfo.com.ArtemisCEAB5875BC83.15186.12868.UNOFFICIAL
Create hunting rule

Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/707294
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Detected Nanocore Rat
Found malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Malicious sample detected (through community Yara rule)
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM3
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 402568 Sample: transfer pdf.exe Startdate: 03/05/2021 Architecture: WINDOWS Score: 100 38 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->38 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 10 other signatures 2->44 7 transfer pdf.exe 7 2->7         started        process3 file4 30 C:\Users\user\AppData\Roaming\mrCqHfpog.exe, PE32 7->30 dropped 32 C:\Users\user\AppData\Local\...\tmp1C2B.tmp, XML 7->32 dropped 46 Adds a directory exclusion to Windows Defender 7->46 11 transfer pdf.exe 7->11         started        16 powershell.exe 24 7->16         started        18 powershell.exe 23 7->18         started        20 2 other processes 7->20 signatures5 process6 dnsIp7 36 23.105.131.171, 4040, 49715, 49717 LEASEWEB-USA-NYC-11US United States 11->36 34 C:\Users\user\AppData\Roaming\...\run.dat, data 11->34 dropped 48 Hides that the sample has been downloaded from the Internet (zone.identifier) 11->48 22 conhost.exe 16->22         started        24 conhost.exe 18->24         started        26 conhost.exe 20->26         started        28 conhost.exe 20->28         started        file8 signatures9 process10
Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/56f803925d37e489e72c9e3a7bf128d46fd29b62f858961b2f644edf09530602/
Threat name:
Win32.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-05-03 07:31:07 UTC
AV detection:
4 of 47 (8.51%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=k34ahes5g7sitzzmty5hx4ji2rx5fg3c7bmjmgzpmrhn6cktayba._file
Verdict:
unknown
Similar samples:
05b6ee8ad090962be89b9f9d1c604541bfc1914e94c245bad6f469988eed019c
NanoCore
145c2f548e969570bdea146f357b1e95c933ab8d81961a93b70180b8bb9508a8
NanoCore
1514ac17df22efd38c94f55862e01bd17ccf24def18924566e50dd5a1721eefa
NanoCore
7faf86e2c9fbd54192ebe7cb795e281aea66f0eef72bdef7240e1e543aedc614
NanoCore
a14ae718bd486d1db0ac41a00f37ce34808fd267ee1286663a00f1baea7069d5
NanoCore
bdd3e02711a244f9cdb3af3fed65a5b94fdce88a3a5686b3f32bef9f64ceb555
NanoCore
c889674476922af3c1a1d98a9f03897710d3304dcaeae7ab8b7bc98de854f6ad
NanoCore
ce8de6e2f70e2c2e688ef8dd1693a0356b01ce9a31e06a0b6cb11b8eceb2509e
NanoCore
df494c6249f44756940197fb95d546756d48319398202f902b5d989cf8ffc50f
NanoCore
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/210503-5g3edm3zex/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Suspicious use of SetThreadContext
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
23.105.131.171:4040
Unpacked files
SH256 hash:
bdf79e57b5574f9bafb56f6d0592f5ee429df7eb0ad536fbdb4f2956aae36f87
MD5 hash:
826b29e2a141b055a5491c9d7dc6eea7
SHA1 hash:
af4201362b8603bf7e4b6e2ead1cfb610dd7c0a9
Link:
https://www.unpac.me/results/c52dd6d0-fa5a-4b9f-8a88-90f2bb165bd5/
SH256 hash:
56f803925d37e489e72c9e3a7bf128d46fd29b62f858961b2f644edf09530602
MD5 hash:
ceab5875bc8300bade1fa862d446af5b
SHA1 hash:
7f181a1500e1b2cbf7c76466210c58d166c30c62
Link:
https://www.unpac.me/results/c52dd6d0-fa5a-4b9f-8a88-90f2bb165bd5/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/56f803925d37e489e72c9e3a7bf128d46fd29b62f858961b2f644edf09530602

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/148286/

Comments