MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72226e94b46283845dadd5cd465bdd84240bc2eab9728cddaed267401e78c23f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72226e94b46283845dadd5cd465bdd84240bc2eab9728cddaed267401e78c23f
SHA3-384 hash: 99382cdc42c1e5518bf1f7338dd46a2631d2e375b7cf077fd35d8e5394baa499a6d583c745db792d2027a40b82b0b3bc
SHA1 hash: e64aacd085dc9e6c85cd9375a132843ef46cdb42
MD5 hash: 9e6ede79ce5bc709f800567f18e70b43
humanhash: lithium-paris-nitrogen-saturn
File name:9e6ede79ce5bc709f800567f18e70b43.exe
Download: download sample
Signature NanoCore
Create hunting rule
File size:649'728 bytes
First seen:2020-07-20 07:37:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 18cb1753a10ac437b1e45b0361d426a6 (5 x AgentTesla, 3 x MassLogger, 3 x NanoCore)
ssdeep 12288:WRkDC2ugt0FPWW049gyUeGTOiCERxU7TzHjD9DCRm0OHstZeqRVkIYe:WSGE0FpCqi/Uv7XUR1OHs1
Threatray 2'363 similar samples on MalwareBazaar
TLSH D3D4BF66F2E04433D163367B9C5B57B4A83ABF9C3D2819462BE85DCC5F38742385A293
Reporter abuse_ch
Tags:exe NanoCore RAT


Avatar
abuse_ch
NanoCore RAT C2:
officeofgrace.duckdns.org:1990 (37.49.224.252)

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/28562/
Detection(s):
PUA.Win.Packer.BorlandDelphi-15
Create hunting rule

PUA.Win.Adware.Slugin-6803969-0
Create hunting rule

PUA.Win.Adware.Slugin-6840354-0
Create hunting rule

SecuriteInfo.com.Win32.Herz.B.10219.20314.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Unauthorized injection to a recently created process
Creating a file in the %temp% subdirectories
Reading critical registry keys
Creating a file
Deleting a recently created file
Reading Telegram data
Running batch commands
Creating a process with a hidden window
Launching a process
Sending a TCP request to an infection source
Stealing user critical data
Result
Threat name:
Nanocore
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/390964
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 247602 Sample: PlFGPQrpdy.exe Startdate: 20/07/2020 Architecture: WINDOWS Score: 100 77 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->77 79 Found malware configuration 2->79 81 Malicious sample detected (through community Yara rule) 2->81 83 10 other signatures 2->83 14 PlFGPQrpdy.exe 2->14         started        17 jsdhdh.exe 2->17         started        19 wscript.exe 1 2->19         started        process3 signatures4 95 Writes to foreign memory regions 14->95 97 Allocates memory in foreign processes 14->97 99 Queues an APC in another process (thread injection) 14->99 101 Contains functionality to detect sleep reduction / modifications 14->101 21 notepad.exe 5 14->21         started        103 Maps a DLL or memory area into another process 17->103 25 jsdhdh.exe 17->25         started        27 jsdhdh.exe 3 17->27         started        29 jsdhdh.exe 19->29         started        process5 file6 63 C:\Users\user\AppData\Roaming\...\jsdhdh.exe, PE32 21->63 dropped 65 C:\Users\user\...\jsdhdh.exe:Zone.Identifier, ASCII 21->65 dropped 67 C:\Users\user\AppData\Roaming\...\wen.vbs, ASCII 21->67 dropped 87 Creates files in alternative data streams (ADS) 21->87 89 Drops VBS files to the startup folder 21->89 31 jsdhdh.exe 21->31         started        34 jsdhdh.exe 25->34         started        69 C:\Users\user\AppData\...\jsdhdh.exe.log, ASCII 27->69 dropped 36 jsdhdh.exe 29->36         started        signatures7 process8 signatures9 105 Multi AV Scanner detection for dropped file 31->105 107 Detected unpacking (changes PE section rights) 31->107 109 Detected unpacking (creates a PE file in dynamic memory) 31->109 113 3 other signatures 31->113 38 jsdhdh.exe 13 31->38         started        43 jsdhdh.exe 31->43         started        111 Maps a DLL or memory area into another process 34->111 process10 dnsIp11 75 officeofgrace.duckdns.org 37.49.224.252, 1990, 49718 XEMUXEMUNL Estonia 38->75 71 C:\Users\user\AppData\Roaming\...\run.dat, ISO-8859 38->71 dropped 73 C:\Users\user\AppData\Local\...\tmpCE0F.tmp, XML 38->73 dropped 91 Hides that the sample has been downloaded from the Internet (zone.identifier) 38->91 45 schtasks.exe 1 38->45         started        file12 signatures13 process14 process15 47 conhost.exe 45->47         started        process16 49 jsdhdh.exe 47->49         started        51 jsdhdh.exe 47->51         started        process17 53 jsdhdh.exe 49->53         started        signatures18 85 Maps a DLL or memory area into another process 53->85 56 jsdhdh.exe 53->56         started        58 jsdhdh.exe 53->58         started        process19 process20 60 jsdhdh.exe 56->60         started        signatures21 93 Maps a DLL or memory area into another process 60->93
Detection:
nanocore
Create hunting rule
Link:
https://mwdb.cert.pl/sample/72226e94b46283845dadd5cd465bdd84240bc2eab9728cddaed267401e78c23f/
Threat name:
Win32.Infostealer.Fareit
Create hunting rule
Status:
Malicious
First seen:
2020-07-20 07:39:05 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=oirg5ffumkbyixnn2xgumw65qqsaxqxkxfzizxno2jtuahtyyi7q._file
Verdict:
malicious
Label(s):
nanocorerat
Create hunting rule
hawkeyekeylogger
Create hunting rule
Similar samples:
175bdb11453e65abc7c2d64a37b69d0bea771353c4eefbaa0d3ffb649292e2fc
NanoCore
366bac9db38e89bd47b0128bdf62a4f986d1d27449c12920744e157b819751f1
NanoCore
3874eba497e0b61949d0772430ce1df420e28777dba850a6033295212e9de9c5
NanoCore
5901a8e4a36574b8ca6cb3c899e64cdfc27395de606cd4a512431e6dd827196f
NanoCore
5e4da067908b56292fc2595a72378a091feccd8090b6ba186db4287c94a68680
NanoCore
75f0a0c09c70fb729182f35452ce0dc8bfcdb9aa626b228cd05c832647d2b058
NanoCore
7dfd68770a471f5991cb5b91816584e1c8e6c764bd4d8655c2d752099c5ad057
NanoCore
a337bd46dfdc25f5d50ea783b87c7a38e5ef7b6bfd031662c1d857e593869e19
NanoCore
d53439692180d901981bcff18c2d0db8b349a8f4118c5682943c5dd22678af94
NanoCore
ff5fb544251818945ba7b14fb0602d71188133caf7742871318291c91b474013
NanoCore
+ 2'353 additional samples on MalwareBazaar
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
upx evasion trojan keylogger stealer spyware family:nanocore
Link:
https://tria.ge/reports/200720-npwbav9xwn/
Behaviour
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
NTFS ADS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of SetThreadContext
Checks whether UAC is enabled
Loads dropped DLL
Drops startup file
Executes dropped EXE
UPX packed file
NanoCore
Malware Config
C2 Extraction:
officeofgrace.duckdns.org:1990
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Unknown
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/72226e94b46283845dadd5cd465bdd84240bc2eab9728cddaed267401e78c23f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:win_nanocore_w0
Create hunting rule
Author: Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

NanoCore

Executable exe 72226e94b46283845dadd5cd465bdd84240bc2eab9728cddaed267401e78c23f

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/28562/
  
URLhaus
https://urlhaus.abuse.ch/url/412465/
  
Delivery method
Distributed via web download

Comments