MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 639b1e539bcaeaf95b0c6e64ca52831a4287ecd5748ff13824a60a8b25b26fbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 8


Intelligence 8 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 639b1e539bcaeaf95b0c6e64ca52831a4287ecd5748ff13824a60a8b25b26fbf
SHA3-384 hash: bf3a1c1caee8c5f56e0fd0b3091b69699170f2930bd686b1c0969d7443934e8d2766573dbfdac21c6d7b77d3e8bd2992
SHA1 hash: 91ea2a10b00b38e28c74bdc7df1b7da85ee90112
MD5 hash: 0ca57894e3bafca99c457aaec5e23a72
humanhash: winter-helium-solar-fillet
File name:invoice.scr
Download: download sample
Signature NanoCore
Create hunting rule
File size:966'144 bytes
First seen:2020-07-10 05:29:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 6e63d8c4f95b00f80e5b95c70d92a973 (10 x AgentTesla, 3 x FormBook, 2 x NanoCore)
ssdeep 12288:rGvZepMqJ07C6YHyrn9baFbUBXrVAlLSju/ULekhK6/uH/WL/KCauSpb1UnsppX:rIgpM+F6YHyDYFYUNS2I92HuLo1ppB
Threatray 3'260 similar samples on MalwareBazaar
TLSH 8125AE26F3D04933D37A1639DC5B566499EABE412D389D463BF46F4C8E3934238362A3
Reporter abuse_ch
Tags:NanoCore nVpn RAT scr


Avatar
abuse_ch
Malspam distributing NanoCore:

HELO: slot0.ndmpef.gq
Sending IP: 104.168.149.160
From: Ms. Lilian Kate<liliank@adendorf.co.za>
Reply-To: <eurosales@yandex.ru>
Subject: FW:Invoice
Attachment: invoice.001 (contains "invoice.scr")

NanoCore RAT C2:
harolds.ooguy.com:6051 (79.134.225.88)

Pointing to nVpn:

% Information related to '79.134.225.64 - 79.134.225.127'

% Abuse contact for '79.134.225.64 - 79.134.225.127' is 'abuse@your-vpn.network'

inetnum: 79.134.225.64 - 79.134.225.127
netname: YOUR_VPN_NETWORK
country: DE
remarks: ****************************************************
remarks: This subnet belongs to a VPN service provider.
remarks: We protect the right to privacy, which means
remarks: we don't log the activities of our users.
remarks: ****************************************************
admin-c: EH4074-RIPE
tech-c: YVN10-RIPE
status: ASSIGNED PA
abuse-c: YVN10-RIPE
org: ORG-YVN1-RIPE
mnt-by: AF15-MNT
created: 2019-07-19T18:26:38Z
last-modified: 2019-07-19T18:51:28Z
source: RIPE

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection:
NanoCore
Create hunting rule
Link:
https://www.capesandbox.com/analysis/24183/
Detection(s):
PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Trojan.Delf.FareIt.Gen.7.17255.16370.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file in the %AppData% subdirectories
DNS request
Connection attempt to an infection source
Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/639b1e539bcaeaf95b0c6e64ca52831a4287ecd5748ff13824a60a8b25b26fbf/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-09 19:40:00 UTC
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=monr4u43zlvpswymnzsmuuuddjbip3gvosh7cobeuyfiwjnsn67q._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
06c57d4b322f81ecbab54213b8850ecd29408f5ca5814641927cd5c5c3acb892
NanoCore
3c6902ab74526dac496d24e6be3db45c54d4ccc2530725c353dee1495c34b7e8
NanoCore
4d10520e2b80ca42e98590435c36c5409a458d9a5bd0ad35b0f444d2ceb2626d
NanoCore
6deceb88f30de5953a4a9de2fd70415302205f306cdf62e14c922fee23ea721e
NanoCore
7748f1dcea952ed6c4fca8e3bfa378bbb2e3d2da2938a9215d988c16207b1eb8
NanoCore
961151f7d903eb436995b695acc2daf05122527dbeb963fce0bbcefa16eeb44f
NanoCore
c9fbaba2cece9a148814fc244e4975de08a58d5fc1ccab3132a29748d8e863e2
NanoCore
d5428c33e4529ecf6c9c4b338a65c7f9d990f956744da9a8089d6b9a0156f9f9
NanoCore
e53ac115afc84ba420fa56287a73f4f59ad1c4eaafaf845f523d9d86418750e9
NanoCore
f807d6a3339a63f67915e72bddec1bc3b2e02e2b26102b37a464e32eb646af09
NanoCore
+ 3'250 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
evasion trojan keylogger stealer spyware family:nanocore
Link:
https://tria.ge/reports/200710-p245llrvp2/
Behaviour
Suspicious behavior: MapViewOfSection
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
UPX packed file
NanoCore
Malware Config
C2 Extraction:
harolds.ooguy.com:6051
harold.jetos.com:6051
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

NanoCore

rar d5d024d2a5c44b0392090b5644787c5fa9ea3694852ee7fe6c8220130a74f6e8

NanoCore

Executable exe 639b1e539bcaeaf95b0c6e64ca52831a4287ecd5748ff13824a60a8b25b26fbf

(this sample)

  
Dropped by
MD5 5e1eaf93f889bf5e27eb7fddc7cd5750
  
Delivery method
Distributed via e-mail attachment
  
Dropped by
SHA256 d5d024d2a5c44b0392090b5644787c5fa9ea3694852ee7fe6c8220130a74f6e8
Cape
Cape
https://www.capesandbox.com/analysis/24183/

Comments