MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 644a0403a3c8254a3846b8c07aa7fdeb2cfe21aa5630ca3100949869f60ae407. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 4


Intelligence 4 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 644a0403a3c8254a3846b8c07aa7fdeb2cfe21aa5630ca3100949869f60ae407
SHA3-384 hash: b61d1acad4a8df600f05ac7d5997182f44a7da22d75e6833438e72cbfa73604ddaf2ac61df952bdf27ed2e1da7a39244
SHA1 hash: 66377b75408deb6b0bd5059b196451425154e1e3
MD5 hash: 1dd0d4dd8d512ce477ab17bb237def6b
humanhash: crazy-sodium-shade-lion
File name:sysaudio.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:334'336 bytes
First seen:2020-05-24 07:30:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'737 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 6144:p+o2W6AbBq1FbcCx3cpxJ/Mr+gfiXDM2KDWVXykT9uv5dwNcmahX1aMlJx264:p+ornqbBZc7BMQfIWRcv5dwGtlJx2
Threatray 1'166 similar samples on MalwareBazaar
TLSH A064F234FD889A77CA5C567C80A1110213F68E523A9FE3D4EC9D72E622B37E904697D3
Reporter abuse_ch
Tags:Chase exe NanoCore RAT


Avatar
abuse_ch
Malspam distributing AveMariaRAT:

HELO: slot0.syspostal.pw
Sending IP: 192.119.106.124
From: Chase Bank <postmaster@syspostal.pw>
Subject: Funds has bee Transfered
Attachment: Payment_Details.img (contains "Payment_Details.exe")

AveMariaRAT dropping NanoCore RAT

NanoCore RAT payload URL:
http://mysipro.com/sysaudio.exe

AveMariaRAT C2:
51.89.204.165:52001

NanoCore RAT C2:
216.170.119.19:24980

Intelligence

File Origin
# of uploads :
1
# of downloads :
80
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.MSIL.Kryptik.VFR-1.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
ByteCode-MSIL.Trojan.Agensla
Create hunting rule
Status:
Malicious
First seen:
2020-05-24 01:15:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
2
AV detection:
24 of 31 (77.42%)
Threat level:
  2/5
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
Similar samples:
1583c29f396b51c03866ecbac92dfae57d41c361d8f6f5ae71600a84a4b9033d
NanoCore
23fb5bf57b70184335261dec8c9bd0976ef8c61d843486ffdc5692aa9618e58e
NanoCore
289c596406900aae22ba6b3d5a9d5465e38faebb46698f89def637389f675ae6
NanoCore
85eda0bfb0c5ef225846a360db05fad91f83aba3b5bda3f7b8ade56f7a875a7c
NanoCore
bd06d782b92aa3a26b476fb5f8c89127d8c663b6a78b40cc62bf17975be348d5
NanoCore
c13ebcd5694fe6c489f6c829828bf20c4cc3008da2c75fe2cf39fda68d1024a6
NanoCore
c7434a901ef82dba7f31d229cf40797bae4b6486378262b55120446cf469bfe2
NanoCore
d4b3ccca8a4726bb5093a9109c319456bc557b31a871c1b468c832e076f14b2f
NanoCore
e023ce4ffdc54618b4e82be87714469c550ebb767e17e7c793f681e24e9c8fd9
NanoCore
e16297ef56ee81e53dd0bed2d0891132899dba6b888737f0e21a38b361a34a64
NanoCore
+ 1'156 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore evasion keylogger spyware stealer trojan
Link:
https://tria.ge/reports/201109-sshcyg3bsj/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
Checks whether UAC is enabled
NanoCore
Malware Config
C2 Extraction:
216.170.119.19:24980
ufok.duckdns.org:24980
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AveMariaRAT

img 563601030d202ab4d9e7890d60ad715915c52f3421add61ac0ebd8301f105db1

AveMariaRAT

Executable exe a8744a3ac642e71bfd57f1476bb54d94aee2d6f80ad4b41548931685debec08e

NanoCore

Executable exe 644a0403a3c8254a3846b8c07aa7fdeb2cfe21aa5630ca3100949869f60ae407

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/367447/
  
Dropped by
AveMariaRAT
  
Dropped by
SHA256 a8744a3ac642e71bfd57f1476bb54d94aee2d6f80ad4b41548931685debec08e
  
Dropped by
MD5 5c7b2174792679ffe2ae09dd23e27474
  
Delivery method
Distributed via web download

Comments