MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7943dd3d1f4215ee40123ab13edc945dccd0ff9d3e9cddf372ff8ecbffe62635. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

NanoCore

Vendor detections: 8

Intelligence 8 IOCs YARA 5 File information Comments

SHA256 hash:	7943dd3d1f4215ee40123ab13edc945dccd0ff9d3e9cddf372ff8ecbffe62635
SHA3-384 hash:	2b5c7c1875b375f281d63a2dc9121c30e20e6573903ae25ec97eb9c7f3daf307a1220f0d89bf0f5cc5512021493c1d48
SHA1 hash:	71fb505cb1333272197f7a034061253ec52fdb59
MD5 hash:	5b5369b2f6c3375da64a1ab886f50f9f
humanhash:	london-west-west-seven
File name:	FILE.exe
Download:	download sample
Signature	NanoCore Create hunting rule
File size:	1'073'771 bytes
First seen:	2020-07-13 12:37:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep	24576:6NA3R5drXdtAdsPP1UlgYAoJpIAPXXYyhi9tndvBH29jZFQYcHO6lIF6s:z5bAa6lbVJpIMXIQi5vN29jZ63iF6s
Threatray	1'339 similar samples on MalwareBazaar
TLSH	2C351203BAD684B2E5730D35593AA320697CBE306F34CE9FA7C51DBD85364809635BB2
Reporter	abuse_ch
Tags:	exe NanoCore RAT Yahoo

abuse_ch

Malspam distributing NanoCore:

HELO: sonic303-20.consmr.mail.ir2.yahoo.com
Sending IP: 77.238.178.201
From: abbass baradaran <abbass_1330@yahoo.com>
Reply-To: abbass baradaran <abbass_1330@yahoo.com>
Subject: RE: Specifications
Attachment: FILE.z (contains "FILE.exe")

NanoCore RAT C2:
johnsuccess18.ddns.net:52943 (154.118.75.121)
johnsuccess18.ddns.net:52943 (41.217.83.84)

Intelligence

File Origin

# of uploads :

# of downloads :

114

Origin country :

n/a

Vendor Threat Intelligence

Detection:

Nanocore

Link:

https://www.capesandbox.com/analysis/25326/

Detection(s):

Win.Malware.Autoit-7599063-0

SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Searching for the window

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for recently created files

Creating a process from a recently created file

Creating a file

Launching a process

Forced system process termination

Creating a file in the Program Files subdirectories

Creating a file in the %temp% directory

Deleting a recently created file

DNS request

Blocking a possibility to launch for the Windows Task Manager (taskmgr)

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Connection attempt to an infection source

Unauthorized injection to a system process

Enabling autorun with Startup directory

Detection:

nanocore

Link:

https://mwdb.cert.pl/sample/7943dd3d1f4215ee40123ab13edc945dccd0ff9d3e9cddf372ff8ecbffe62635/

Threat name:

Win32.Trojan.NanoBot

Status:

Malicious

First seen:

2020-07-13 12:39:05 UTC

AV detection:

21 of 28 (75.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=pfb52pi7iik64qashkyt5xeulxgnb745h2on343s76hmx77gey2q._file

Verdict:

malicious

Label(s):

nanocorerat

NanoCore

23005e23c85ef953237d9107f4542a08afc83f4d921191b78cc983f7aebfea21

NanoCore

251c55b7c7c02eec9a87eca94bb01f653317ef5d8278aeb2b511194d7057a675

NanoCore

4cc5f468994fd62cc832482404cfc7e45232f059b9d355d3df41535a170b3470

NanoCore

61f312d2472d658a6570f3e96fc4543309a304d9415e86b1c9306f2baacc9563

NanoCore

87ee5e680c1334c8945b1448819310331304593ad7b4356807bed6d857060226

NanoCore

8d3c18b852f38c03b74ec7de7771a9f93e6f5e3aa44d3863567d984fed0c6d88

NanoCore

9e1de81ecb080a9d970953a62de72b6a83cc61776409098f1429c11032cbfa14

NanoCore

a94d174668553fbeb3c27e3194f9cef33d0d24ca56891658911bfdd7451ae9f8

NanoCore

d35f40a630b2e4b24ec76c354e1e66d927afe339aaba45ff3c750ed52193c910

NanoCore

+ 1'329 additional samples on MalwareBazaar

Result

Malware family:

nanocore

Score:

10/10

Tags:

evasion persistence keylogger trojan stealer spyware family:nanocore

Link:

https://tria.ge/reports/200713-fpc68q4bd2/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Drops file in Program Files directory

Suspicious use of SetThreadContext

Adds Run entry to start application

Checks whether UAC is enabled

Loads dropped DLL

Executes dropped EXE

Disables Task Manager via registry modification

NanoCore

Malware Config

C2 Extraction:

johnsuccess18.ddns.net:52943
154.16.93.185:52943

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_NanoCore Create hunting rule
Author:	abuse.ch

Rule name:	Nanocore Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Nanocore in memory
Reference:	internal research

Rule name:	Nanocore_RAT_Feb18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects Nanocore RAT
Reference:	Internal Research - T2T

Rule name:	Nanocore_RAT_Gen_2 Create hunting rule
Author:	Florian Roth
Description:	Detetcs the Nanocore RAT
Reference:	https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/