MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fd2a9f7370fb2395eba599c52c1a8297d2e5074dea8122e181a3be762b0fac2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5fd2a9f7370fb2395eba599c52c1a8297d2e5074dea8122e181a3be762b0fac2
SHA3-384 hash: df04593a016db5acef5edefd3de4af2cd1625b654f231f06737dc83ef5b7d19ed20da165a63a62754b57f68c1d63bb76
SHA1 hash: fddfec2eb1d65c56172de7c53d6dfa46224d5447
MD5 hash: 3f3e89adafc44b5949999aaaf1c8d471
humanhash: hydrogen-diet-eleven-don
File name:Bestellung 2020-032208 .exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:548'864 bytes
First seen:2020-08-27 05:40:37 UTC
Last seen:2020-08-27 07:19:19 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'662 x AgentTesla, 19'474 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 12288:s4Rnhcq5hNVE2sEHWa2TTo6k96Bgf8+OjWN4QodVq82WJaH:tNVE/iWaSM6kPf9gWNCq82Ya
Threatray 1'123 similar samples on MalwareBazaar
TLSH E1C412A4037DDF46E5FE17BDE86E310007F2745664B5E35EEE80E0A924FAB908921763
Reporter abuse_ch
Tags:DEU exe geo NanoCore RAT


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: web4.allinhost.de
Sending IP: 178.77.72.166
From: info <info@heute-gmbh.de>
Subject: Bestellung 2020-032208
Attachment: Bestellung 2020-032208 .iso (contains "Bestellung 2020-032208 .exe")

Intelligence

File Origin
# of uploads :
2
# of downloads :
184
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/51592/
Detection(s):
SecuriteInfo.com.Fareit-FYV3F3E89ADAFC4.12154.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a window
Creating a file in the %AppData% directory
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Unauthorized injection to a recently created process
Creating a file
Creating a file in the %AppData% subdirectories
DNS request
Connection attempt to an infection source
Enabling autorun by creating a file
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/452261
Signature
.NET source code contains potential unpacker
Binary contains a suspicious time stamp
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Detected Nanocore Rat
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: NanoCore
Sigma detected: Scheduled temp file as task from temp location
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses dynamic DNS services
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected AntiVM_3
Yara detected Nanocore RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 278490 Sample: Bestellung 2020-032208 .exe Startdate: 27/08/2020 Architecture: WINDOWS Score: 100 47 Malicious sample detected (through community Yara rule) 2->47 49 Multi AV Scanner detection for dropped file 2->49 51 Sigma detected: Scheduled temp file as task from temp location 2->51 53 11 other signatures 2->53 8 Bestellung 2020-032208 .exe 5 2->8         started        12 Bestellung 2020-032208 .exe 2 2->12         started        process3 file4 35 C:\Users\user\AppData\Roaming\taOJFt.exe, PE32 8->35 dropped 37 C:\Users\user\AppData\Local\...\tmpF197.tmp, XML 8->37 dropped 39 C:\Users\...\Bestellung 2020-032208 .exe.log, ASCII 8->39 dropped 55 Injects a PE file into a foreign processes 8->55 14 Bestellung 2020-032208 .exe 11 8->14         started        19 schtasks.exe 1 8->19         started        21 Bestellung 2020-032208 .exe 8->21         started        23 schtasks.exe 1 12->23         started        25 Bestellung 2020-032208 .exe 2 12->25         started        signatures5 process6 dnsIp7 43 69tallboy.ddns.net 185.165.153.26, 2669, 49719 DAVID_CRAIGGG Netherlands 14->43 41 C:\Users\user\AppData\Roaming\...\run.dat, Non-ISO 14->41 dropped 45 Hides that the sample has been downloaded from the Internet (zone.identifier) 14->45 27 schtasks.exe 1 14->27         started        29 conhost.exe 19->29         started        31 conhost.exe 23->31         started        file8 signatures9 process10 process11 33 conhost.exe 27->33         started       
Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/5fd2a9f7370fb2395eba599c52c1a8297d2e5074dea8122e181a3be762b0fac2/
Threat name:
ByteCode-MSIL.Spyware.Noon
Create hunting rule
Status:
Malicious
First seen:
2020-08-27 05:42:08 UTC
AV detection:
22 of 29 (75.86%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=l7jkt5zxb6zdsxv2lgoffqniff6s4udu32ubelqydi56oyvq7lba._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
2cc946f811083d61e8d5d5892188799086aec88c8f9a2dd68a3af4af2bc07e28
NanoCore
3cb221973d52d12fc900f37496a9c5f77b30da63886a0f7d54111982c00e872b
NanoCore
62a7f441ba21aaa568fe700029fa32d6dd7eeb2ed0a7f7259a680f2aae65ee31
NanoCore
708e8ea4397b44ad8e1ea8ef53b0697dec1e09b6c454c7bf4654120e04a903f8
NanoCore
83b70b20d0cdb13e9c420723ba5f025827d21e0c051c6e64b5553a5c372c3374
NanoCore
b87295a4b2fb2d2f4df9d502d52e2f50a5e9b3ba9f56b17e252fa0f3022ae6f4
NanoCore
c906c5770bebca31da7c8da7a639ec54531022d2a88bc133f89f793e7a3d737d
NanoCore
ccf661061226a4fe358b46c6fab8a29686323e41aa50fe06c06963c9939a2669
NanoCore
d86b5f7fffdf4b871b5487b02de0366b3edbd96a75f86a0f57a602796a8136da
NanoCore
e7fa1cf008969a70a894b2947737b69c26abb63378d9d4305b698b223793029f
NanoCore
+ 1'113 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
evasion trojan keylogger stealer spyware family:nanocore
Link:
https://tria.ge/reports/200827-ttcbg5by6a/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
69tallboy.ddns.net:2669
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farheyt
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/5fd2a9f7370fb2395eba599c52c1a8297d2e5074dea8122e181a3be762b0fac2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

iso 8ee38f93343d9f526c2f0560efe99c3364f7d276c0fbfbd613dc278ded0f590e

NanoCore

Executable exe 5fd2a9f7370fb2395eba599c52c1a8297d2e5074dea8122e181a3be762b0fac2

(this sample)

  
Dropped by
MD5 f0a0d2ae7f5dc8c4ec9cd2c5f116cf8b
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/51592/
  
Dropped by
SHA256 8ee38f93343d9f526c2f0560efe99c3364f7d276c0fbfbd613dc278ded0f590e

Comments