MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74eb0a80b15f5d8d63d67498479e28dc191f8349d017ca0d0af2474a4d7c1fc0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


NanoCore


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 74eb0a80b15f5d8d63d67498479e28dc191f8349d017ca0d0af2474a4d7c1fc0
SHA3-384 hash: 9cb857ee90e768aa4c2a101271d9de84ec79c348161504c2e1a8ce639f074edf8e484efae895737b1c866989e0f1cc14
SHA1 hash: 4a041ad3c3b0eb1f01eb2bd6432551cce09e3f7f
MD5 hash: 12f73db04308d855406befe984cb1123
humanhash: comet-lactose-social-bulldog
File name:SECURE.Ps1
Download: download sample
Signature NanoCore
Create hunting rule
File size:972'275 bytes
First seen:2026-02-26 19:56:42 UTC
Last seen:2026-02-26 19:57:40 UTC
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 24576:jn2iM7wpKXbtn+eZ/4KX/LhKZKuRmNhfPu:SMpKXbFvX/L8RkG
TLSH T127259CCEBD4016F6A327DDB44B5EADE42CB2B7737C5279207062189F4ABD12C41BE825
Magika powershell
Reporter BastianHein
Tags:NanoCore ps1

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
158.94.209.22:39888 https://threatfox.abuse.ch/ioc/1755184/

Intelligence

File Origin
# of uploads :
2
# of downloads :
47
Origin country :
CL CL
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.32053.BadPs1.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69a0a58e8fffa866e3b2848f
Tags:
ransomware nanocore trojan remo
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
aspnet_compiler base64 evasive lolbin obfuscated obfuscated powershell reconnaissance
Link:
https://www.filescan.io/uploads/69a0a59a97feb4afd65da330/reports/a910ff2c-2eab-4034-a480-e06535c90ecd/overview
Verdict:
Suspicious
Labled as:
PowerShell/Agent.DUQ trojan
Link:
https://www.hybrid-analysis.com/sample/74eb0a80b15f5d8d63d67498479e28dc191f8349d017ca0d0af2474a4d7c1fc0
Verdict:
Malicious
File Type:
ps1
Detections:
Trojan-PSW.Agensla.TCP.ServerRequest Trojan.Win32.InjectorNetT.s Trojan.Agent.TCP.ServerRequest PDM:Trojan.Win32.Generic Backdoor.NanoBot.TCP.C&C
Link:
https://opentip.kaspersky.com/74eb0a80b15f5d8d63d67498479e28dc191f8349d017ca0d0af2474a4d7c1fc0/results?tab=lookup
Score:
96%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/74eb0a80b15f5d8d63d67498479e28dc191f8349d017ca0d0af2474a4d7c1fc0
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/74eb0a80b15f5d8d63d67498479e28dc191f8349d017ca0d0af2474a4d7c1fc0/
Verdict:
Malicious
Threat:
Family.NANOCORE
Link:
https://tip.neiki.dev/file/74eb0a80b15f5d8d63d67498479e28dc191f8349d017ca0d0af2474a4d7c1fc0
Threat name:
Script-PowerShell.Trojan.InjectorNetT
Create hunting rule
Status:
Malicious
First seen:
2026-02-26 10:10:44 UTC
File Type:
Text (PowerShell)
AV detection:
5 of 36 (13.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=otvqvafrl5oy2y6wosmephri3qmr7a2j2al4udik6jduutl4d7aa._file
Verdict:
malicious
Label(s):
fantomcrypt
Create hunting rule
Similar samples:
error
NanoCore
Result
Malware family:
nanocore
Create hunting rule
Score:
  10/10
Tags:
family:nanocore discovery execution keylogger persistence spyware stealer trojan
Link:
https://tria.ge/reports/260226-ypckysdz9a/
Behaviour
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Command and Scripting Interpreter: PowerShell
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Suspicious use of SetThreadContext
Adds Run key to start application
Executes dropped EXE
NanoCore
Nanocore family
Malware Config
C2 Extraction:
158.94.209.22:39888
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/74eb0a80b15f5d8d63d67498479e28dc191f8349d017ca0d0af2474a4d7c1fc0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_NanoCore
Create hunting rule
Author:abuse.ch
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:malware_Nanocore_strings
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:MALWARE_Win_NanoCore
Create hunting rule
Author:ditekSHen
Description:Detects NanoCore
Rule name:Nanocore
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Nanocore in memory
Reference:internal research
Rule name:nanocore_rat
Create hunting rule
Author:jeFF0Falltrades
Rule name:Nanocore_RAT_Feb18_1
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Feb18_1_RID2DF1
Create hunting rule
Author:Florian Roth
Description:Detects Nanocore RAT
Reference:Internal Research - T2T
Rule name:Nanocore_RAT_Gen_2
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:Nanocore_RAT_Gen_2_RID2D96
Create hunting rule
Author:Florian Roth
Description:Detetcs the Nanocore RAT
Reference:https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:Windows_Trojan_Nanocore_d8c4e3c5
Create hunting rule
Author:Elastic Security
Rule name:win_nanocore_w0
Create hunting rule
Author:Kevin Breen <kevin@techanarchy.net>

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments